Istio - corsPolicy allowOrigin from virtualService not blocking curl requests from different origins

Question

Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a domain match I get it as access-control-allow-origin: https://testthat.com, but if doesn't match I get access-control-allow-origin: *. I am expecting the request to be blocked.

Expected behavior The specified origin unless being set to * should block everything else exclusively.

Steps to reproduce the bug Create a virtual service with CORS allowOrigins set to https://testthat.com, simulate REST API to the service behind it assuming another ORIGIN and the request will return 200.

On 1.6.0 I am using the virtualservice below to whitelist only single domain and with the following curl I am receiving 200 on a different, why isn't it blocked: curl -X OPTIONS 'https://api2.qa.testthat.com/v1/test/something' -H "Origin: https://testthat.com" -v

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  labels:
    app.kubernetes.io/instance: qa-bom
    app.kubernetes.io/managed-by: Tiller
    app.kubernetes.io/name: service-test
    helm.sh/chart: service-test-0.1.0-release-2-7-0-4-227fd9a
  name: service-test
  namespace: qa
spec:
  gateways:
  - api-gateway
  hosts:
  - service-test
  - api2.qa.testthat.com
  http:
  - corsPolicy:
      allowHeaders:
      - Authorization
      - Content-Type
      allowMethods:
      - POST
      - GET
      - PUT
      - PATCH
      - DELETE
      allowOrigins:
      - exact: https://testthat.com
    match:
    - gateways:
      - api-gateway
      method:
        regex: GET|OPTIONS
      uri:
        regex: /v1/test/.*
    route:
    - destination:
        host: service-test
        port:
          number: 8080
        subset: active
      weight: 100

Version (include the output of istioctl version --remote and kubectl version and helm version if you used Helm)

./istioctl version --remote
client version: 1.6.0
control plane version: 1.6.0
data plane version: 1.6.0 (57 proxies)

 kubectl version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:36:19Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}

helm version
Client: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}

cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.4 LTS"
NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.4 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

How was Istio installed? https://istio.io/docs/setup/install/standalone-operator/'

Environment where bug was observed (cloud vendor, OS, etc) On-premise Ubuntu OS