# CVE-2026-39350: Istio AuthorizationPolicy regex injection in serviceAccounts

Source: https://junglewise.ai/threats/cve-2026-39350-istio-authorizationpolicy-regex-injection-in-serviceaccounts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-39350 · Severity: medium · CVSS 5.4 · Published 2026-04-16

Istio, a popular service mesh used to manage and secure communication between microservices, contains a flaw in how it handles security policies. The system incorrectly interprets dots in service account names as wildcards, which could allow unauthorized services to bypass security rules or gain access to restricted data. This could lead to a breach of internal security boundaries within a cloud environment.

Technologies: [istio.io/istio (Go)](https://junglewise.ai/threats/technologies/istio-io-istio), [Istio](https://junglewise.ai/threats/technologies/istio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Istio](https://junglewise.ai/threats/vendors/istio).

## Quick answers

**Is CVE-2026-39350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39350 being exploited in the wild.

**How severe is CVE-2026-39350?** Medium severity, with a CVSS score of 5.4, published 16 April 2026.

**Which products and versions are affected?** istio.io/istio (Go) >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d, SEMVER:introduced=0.0.0-20241024090207-0bf27d49ba4b,fixed=0.0.0-20260403004500-692e460c342d; Istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d.

**Is there a fix for CVE-2026-39350?** Yes. istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39350 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39350?** Check whether you run istio.io/istio (Go) or Istio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- istio.io/istio (Go): upgrade to 0.0.0-20260403004500-692e460c342d or later

  ```sh
  go get istio.io/istio@v0.0.0-20260403004500-692e460c342d
  ```


## Technical details

A vulnerability exists in Istio's AuthorizationPolicy where the 'serviceAccounts' and 'notServiceAccounts' fields incorrectly interpret dots ('.') as regular expression matchers rather than literal characters. Because dots are valid characters in Kubernetes service account names, an attacker can craft a service account name that matches a policy intended for a different account (e.g., 'cert-manager-io' matching a rule for 'cert-manager.io'). This can lead to unintended ALLOW matches or the failure of DENY rules. The issue is fixed in Istio versions 1.29.2, 1.28.6, and 1.27.9.

## Affected products

- Istio Istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d

## Identifiers

- CVE-2026-39350
- GHSA-9gcg-w975-3rjh
- GO-2026-5289

## Timeline

- 2026-04-15: disclosed
- 2026-04-16: advisory

## References

- [https://api.github.com/users/Wernerina](https://api.github.com/users/Wernerina)
- [https://github.com/Wernerina](https://github.com/Wernerina)
- [https://api.github.com/users/Wernerina/gists%7B/gist_id%7D](https://api.github.com/users/Wernerina/gists%7B/gist_id%7D)
- [https://api.github.com/users/Wernerina/repos](https://api.github.com/users/Wernerina/repos)
- [https://avatars.githubusercontent.com/u/151374244?v=4](https://avatars.githubusercontent.com/u/151374244?v=4)
- [https://api.github.com/users/Wernerina/events%7B/privacy%7D](https://api.github.com/users/Wernerina/events%7B/privacy%7D)

## Related threats

- [Istio and Envoy Proxy security vulnerabilities](https://junglewise.ai/threats/gcp-2026-069-6d8e440c)
- [GO-2026-5363 - Istio: SSRF via RequestAuthentication jwksUri in istio.io/istio](https://junglewise.ai/threats/cve-2026-41413-istio-ssrf-via-requestauthentication-jwksuri)
- [Istio JWKS resolver failure exposes hardcoded default keys](https://junglewise.ai/threats/cve-2026-31837-istio-jwks-resolver-failure-exposes-hardcoded-default-keys)
- [Ill-formed headers may lead to unexpected behavior in Istio](https://junglewise.ai/threats/cve-2022-31045-ill-formed-headers-may-lead-to-unexpected-behavior-in-istio)
- [Istio vulnerable to denial of service](https://junglewise.ai/threats/cve-2019-18817-istio-vulnerable-to-denial-of-service)