Is CVE-2026-39350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39350 being exploited in the wild.

How severe is CVE-2026-39350?

Medium severity, with a CVSS score of 5.4, published 16 April 2026.

Which products and versions are affected?

istio.io/istio (Go) >= 0.0.0-20241024090207-0bf27d49ba4b, = 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d.

Is there a fix for CVE-2026-39350?

Yes. istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39350 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39350?

Check whether you run istio.io/istio (Go) or Istio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39350: Istio AuthorizationPolicy regex injection in serviceAccounts

Q: Is there a fix for CVE-2026-39350?

Yes. istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39350 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39350?

Check whether you run istio.io/istio (Go) or Istio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39350 · Severity: medium · CVSS 5.4 · Published 2026-04-16

Istio, a popular service mesh used to manage and secure communication between microservices, contains a flaw in how it handles security policies. The system incorrectly interprets dots in service account names as wildcards, which could allow unauthorized services to bypass security rules or gain access to restricted data. This could lead to a breach of internal security boundaries within a cloud environment.

Technologies: istio.io/istio (Go), Istio. Vendors: Go, Istio.

Quick answers

Is CVE-2026-39350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39350 being exploited in the wild.
How severe is CVE-2026-39350?: Medium severity, with a CVSS score of 5.4, published 16 April 2026.
Which products and versions are affected?: istio.io/istio (Go) >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d, SEMVER:introduced=0.0.0-20241024090207-0bf27d49ba4b,fixed=0.0.0-20260403004500-692e460c342d; Istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d.
Is there a fix for CVE-2026-39350?: Yes. istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39350 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39350?: Check whether you run istio.io/istio (Go) or Istio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later
```
go get istio.io/istio@v0.0.0-20260403004500-692e460c342d
```

Technical details

A vulnerability exists in Istio's AuthorizationPolicy where the 'serviceAccounts' and 'notServiceAccounts' fields incorrectly interpret dots ('.') as regular expression matchers rather than literal characters. Because dots are valid characters in Kubernetes service account names, an attacker can craft a service account name that matches a policy intended for a different account (e.g., 'cert-manager-io' matching a rule for 'cert-manager.io'). This can lead to unintended ALLOW matches or the failure of DENY rules. The issue is fixed in Istio versions 1.29.2, 1.28.6, and 1.27.9.

Affected products

Istio Istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d

Identifiers

CVE-2026-39350
GHSA-9gcg-w975-3rjh
GO-2026-5289

Timeline

2026-04-15: disclosed
2026-04-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.