Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

TRUNG BÌNH 5.4CVE-2026-39350 · GHSA-9gcg-w975-3rjh · GO-2026-5289 · Công bố 15/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-39350 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng istio.io/istio, istio (istio).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.21%, cao hơn 11.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.0.0-20260403004500-692e460c342d, 1.27.9, 1.28.6, 1.29.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
istio.io/istio Go	`≥ 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d`	`0.0.0-20260403004500-692e460c342d`
istio istio	`≥ 1.25.0, < 1.27.9≥ 1.28.0, < 1.28.6≥ 1.29.0, < 1.29.2`	`1.27.91.28.61.29.2`

Mô tả

Impact

The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants.

Patches

Fixes are available in 1.29.2, 1.28.6, and 1.27.9

Workarounds

None

Mô tả của NVD

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.