What is GHSA-9gcg-w975-3rjh?

GHSA-9gcg-w975-3rjh is a security advisory published by GitHub Security Advisories with Medium severity. Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

Which CVE IDs does GHSA-9gcg-w975-3rjh cover?

GHSA-9gcg-w975-3rjh covers the following CVE IDs: CVE-2026-39350. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9gcg-w975-3rjh?

GHSA-9gcg-w975-3rjh has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-9gcg-w975-3rjh?

GHSA-9gcg-w975-3rjh affects 1 product, including: go/istio.io/istio:\u003e= 0.0.0-20241024090207-0bf27d49ba4b, \u003c 0.0.0-20260403004500-692e460c342d.

GHSA-9gcg-w975-3rjhMediumCVSS 5.4

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

Vendor

GitHub Security Advisories

Published

April 16, 2026

Last Modified

April 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-39350 →

📋 Description

Impact

The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants.

Patches

Fixes are available in 1.29.2, 1.28.6, and 1.27.9

Workarounds

None

🎯 Affected products1

go/istio.io/istio:>= 0.0.0-20241024090207-0bf27d49ba4b, < 0.0.0-20260403004500-692e460c342d

🔗 References (4)

https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh
https://nvd.nist.gov/vuln/detail/CVE-2026-39350
https://github.com/istio/istio/commit/692e460c342d8f308a35b6ecbdace47807da8ade
https://github.com/advisories/GHSA-9gcg-w975-3rjh