An Istio AuthorizationPolicy bug causes serviceAccounts fields to misinterpret periods as regular expression metacharacters, allowing names such as cert‑manager.io to match cert‑manager-io, cert‑managerXio, etc. A policy that permits access to the intended account therefore becomes broadly permissive, while an equivalent DENY rule fails to block the variants. This flaw can be exploited to bypass access controls for any service account that contains dots, undermining confidentiality and integrity of services.

Vendors: Istio. Product: Istio. Affected versions include 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1. Fixed releases are 1.27.9, 1.28.6, and 1.29.2. Systems running any of the listed versions are vulnerable until updated.

The vulnerability has a CVSS score of 5.4, indicating moderate severity, and there is no EPSS score available. It is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires the ability to create or modify AuthorizationPolicies. An attacker who can inject a malformed service account name or adjust a policy can gain unintended access, potentially escalating privileges within the mesh.