Istio security fixes for authorization bypass and SSRF.

Istio is an open-source service mesh platform that helps developers connect, secure, and manage microservices-based applications. With features such as traffic management, security policies, and observability tools, Istio simplifies the complexities of microservices architecture, enabling developers to build resilient and scalable applications. Through documentation, tutorials, and community support, Istio provides developers with the tools and resources needed to implement service mesh patterns and improve the reliability and performance of their distributed systems.

Istio

Istio has disclosed two moderate-severity CVEs affecting versions 1.28.0–1.28.5. CVE-2026-39350 (CVSS 5.4) involves regex injection via unescaped dots in AuthorizationPolicy serviceAccounts fields, allowing attackers to bypass ALLOW or DENY policies. CVE-2026-41413 (CVSS 5.0) is an SSRF vulnerability via the jwksUri field in RequestAuthentication, potentially exposing internal metadata services to the control plane. Users should upgrade to Istio 1.29.2 or 1.28.6 to remediate both issues.

Istio / ISTIO-SECURITY-2026-003