Executive brief
Istio, a popular service mesh used to manage and secure communication between microservices, contains a flaw in how it handles security policies. The system incorrectly interprets dots in service account names as wildcards, which could allow unauthorized services to bypass security rules or gain access to restricted data. This could lead to a breach of internal security boundaries within a cloud environment.
Technical details
A vulnerability exists in Istio's AuthorizationPolicy where the 'serviceAccounts' and 'notServiceAccounts' fields incorrectly interpret dots ('.') as regular expression matchers rather than literal characters. Because dots are valid characters in Kubernetes service account names, an attacker can craft a service account name that matches a policy intended for a different account (e.g., 'cert-manager-io' matching a rule for 'cert-manager.io'). This can lead to unintended ALLOW matches or the failure of DENY rules. The issue is fixed in Istio versions 1.29.2, 1.28.6, and 1.27.9.
Affected products
- Istio Istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory