StackRadar

CVE-2026-39350

Medium

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
0.002
11th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
9
of 17,781 indexed, latest versions
Container images
9
deployed by those charts
Fix available
1 of 1
affected package

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

Carried by container images the latest versions of 9 of 17,781 indexed charts deploy, on 9 images.

Affected packageAffected versionsFixed inImages
istio.io/istiogolangv0.0.0-20241214032803-7754674f65d3, v0.0.0-20250403050546-6a112a284106, v0.0.0-20251127165946-6268e25f089a+dirty, v0.0.0-20260211003324-2300e2458ab7+2 more0.0.0-20260403004500-692e460c342d9
OSV records
GHSA-9gcg-w975-3rjh
Also known as
GO-2026-5289

Charts affected

9 by stars
ChartLatestAffected imagesRadar Score
istio-allcode4devsVerified publisher1.2.02 of 6See more

istio-all code4devs 1.2.0

2 of the 6 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d

Open the chart page →

4,784
istio-control-planecode4devsVerified publisher1.0.02 of 3See more

istio-control-plane code4devs 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d

Open the chart page →

2,360
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/pilot:1.29.1f8b0e412ac4a
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc
0.0.0-20260403004500-692e460c342d

Open the chart page →

11,574
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
istio.io/istio@v0.0.0-20251127165946-6268e25f089a+dirty
0.0.0-20260403004500-692e460c342d

Open the chart page →

22,193
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc+dirty
0.0.0-20260403004500-692e460c342d

Open the chart page →

2,900
istio-helm-cnimesosphere1.25.11 of 1See more

istio-helm-cni mesosphere 1.25.1

1 of the 1 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/install-cni:1.29.0ce27c9ce43c8
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260403004500-692e460c342d

Open the chart page →

2,533
istio-helm-istiodmesosphere1.25.11 of 2See more

istio-helm-istiod mesosphere 1.25.1

1 of the 2 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/pilot:1.29.0325156535773
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260403004500-692e460c342d

Open the chart page →

3,777
istio-helm-cnimesosphere-stable1.23.61 of 1See more

istio-helm-cni mesosphere-stable 1.23.6

1 of the 1 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/install-cni:1.23.6ab34c4740f44
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260403004500-692e460c342d

Open the chart page →

3,283
istio-helm-istiodmesosphere-stable1.23.61 of 2See more

istio-helm-istiod mesosphere-stable 1.23.6

1 of the 2 container images this version deploys carry CVE-2026-39350.

Container imageDigestPackageFixed in
istio/pilot:1.23.69c3d6a218181
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260403004500-692e460c342d

Open the chart page →

4,603

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d
2
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260403004500-692e460c342d
2
istio/install-cni:1.23.6ab34c4740f44
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260403004500-692e460c342d
1
istio/install-cni:1.29.0ce27c9ce43c8
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260403004500-692e460c342d
1
istio/pilot:1.29.0325156535773
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260403004500-692e460c342d
1
istio/pilot:1.23.69c3d6a218181
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260403004500-692e460c342d
1
istio/pilot:1.29.1f8b0e412ac4a
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc
0.0.0-20260403004500-692e460c342d
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc+dirty
0.0.0-20260403004500-692e460c342d
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
istio.io/istio@v0.0.0-20251127165946-6268e25f089a+dirty
0.0.0-20260403004500-692e460c342d
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.