~ / search / GHSA-9gcg-w975-3rjh

GHSA-9gcg-w975-3rjh

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-39350

Packages

EcosystemPackageAffectedFixed in
Go istio.io/istio >= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d 0.0.0-20260403004500-692e460c342d

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy incorrectly interpret dots (`.`) as a regular expression matcher. Because `.` is a valid character in a service account name, an `AuthorizationPolicy` ALLOW rule targeting SA e.g. `cert-manager.io` also matches `cert-manager-io`, `cert-managerXio`, etc. A DENY rule targeting the same name fails to block those variants. ### Patches Fixes are available in 1.29.2, 1.28.6, and 1.27.9 ### Workarounds None

References

External links from the advisory. They lead to third-party sites.