Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39350 Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccou… https://www.cve.org/CVERecord?id=CVE-2026-39350
Post summary
The passage identifies CVE‑2026‑39350 affecting specific Istio versions without offering exploitation, mitigation, or technical details.
CVE-2026-39350 AuthorizationPolicy Dot Interpretation Vulnerability in Istio 1.25.0 Through 1.29.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39350
Post summary
The text announces CVE-2026-39350 as an AuthorizationPolicy dot‑interpretation vulnerability affecting Istio versions 1.25.0–1.29.1, with details posted on Vulmon, but it contains no evidence of PoC, exploits, active exploitation, or fixes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | istio | istio | - | - | - |