Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

中 5.4CVE-2026-39350 · GHSA-9gcg-w975-3rjh · GO-2026-5289 · 15/04/2026 公開 · 17/06/2026 更新

要点

CVE-2026-39350 は istio.io/istio, istio (istio) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.21%（全脆弱性の 11.1% より高い）。
対処：0.0.0-20260403004500-692e460c342d, 1.27.9, 1.28.6, 1.29.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
istio.io/istio Go	`≥ 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d`	`0.0.0-20260403004500-692e460c342d`
istio istio	`≥ 1.25.0, < 1.27.9≥ 1.28.0, < 1.28.6≥ 1.29.0, < 1.29.2`	`1.27.91.28.61.29.2`

概要

Impact

The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants.

Patches

Fixes are available in 1.29.2, 1.28.6, and 1.27.9

Workarounds

None

NVD の説明

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.