SB20260420114 - Multiple vulnerabilities in Istio

Description

This security bulletin contains information about 2 vulnerabilities.

1) Permissive Regular Expression (CVE-ID: CVE-2026-39350)

CWE-ID: CWE-625 - Permissive Regular Expression

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass AuthorizationPolicy matching and disclose sensitive information or modify authorization outcomes.

The vulnerability exists due to improper neutralization of special elements in the serviceAccounts and notServiceAccounts fields of AuthorizationPolicy when evaluating service account names containing dots. A remote user can specify a crafted service account name pattern to bypass AuthorizationPolicy matching and disclose sensitive information or modify authorization outcomes.

An ALLOW rule targeting a service account name such as cert-manager.io may also match unintended variants, while a DENY rule targeting the same name may fail to block those variants.

2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-41413)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in RequestAuthentication jwksUri handling when processing a RequestAuthentication resource with a jwksUri pointing to an internal service. A remote user can create a crafted RequestAuthentication resource to disclose sensitive information.

Istiod makes an unauthenticated HTTP GET request to the specified URL without filtering localhost or link-local IP addresses, and the retrieved data can be distributed to Envoy proxies via xDS configuration.

Remediation

Install update from vendor's website.

References

• https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh
• https://github.com/istio/istio/security/advisories/GHSA-fgw5-hp8f-xfhc