diff --git a/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/shared.yml b/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/shared.yml
index d801641cab47..fe0667544448 100644
--- a/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/shared.yml
+++ b/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/shared.yml
@@ -13,7 +13,9 @@ inputs:
 
 expression: |
   nads.items.all(n,
+      !has(n.spec) ||
       !has(n.spec.config) ||
+      n.spec.config == "" ||
       !("type" in parseJSON(n.spec.config)) ||
       parseJSON(n.spec.config).type != "bridge" ||
       ("macspoofchk" in parseJSON(n.spec.config) && parseJSON(n.spec.config).macspoofchk == true)
diff --git a/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/tests/cases.yaml b/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/tests/cases.yaml
index d52df86994e5..4ed9950bf0c9 100644
--- a/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/tests/cases.yaml
+++ b/applications/openshift-virtualization/kubevirt-bridge-mac-spoof-filtering/cel/tests/cases.yaml
@@ -90,3 +90,29 @@ cases:
             spec:
               config: '{"cniVersion": "0.3.1", "type": "bridge", "bridge": "br3",
                 "macspoofchk": false}'
+  - name: NAD with no spec at all is compliant (regression - istio-cni style)
+    expect: true
+    inputs:
+      nads:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: k8s.cni.cncf.io/v1
+            kind: NetworkAttachmentDefinition
+            metadata:
+              name: istio-cni
+              namespace: default
+  - name: NAD with an empty-string config is compliant (regression - parseJSON(""))
+    expect: true
+    inputs:
+      nads:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: k8s.cni.cncf.io/v1
+            kind: NetworkAttachmentDefinition
+            metadata:
+              name: empty-config
+              namespace: default
+            spec:
+              config: ""
diff --git a/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/shared.yml b/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/shared.yml
index 769908fd78d5..c6f372540262 100644
--- a/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/shared.yml
+++ b/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/shared.yml
@@ -13,7 +13,9 @@ inputs:
 
 expression: |
   nads.items.all(n,
+      !has(n.spec) ||
       !has(n.spec.config) ||
+      n.spec.config == "" ||
       !("topology" in parseJSON(n.spec.config)) ||
       parseJSON(n.spec.config).topology != "localnet" ||
       ("vlanID" in parseJSON(n.spec.config) && parseJSON(n.spec.config).vlanID > 0)
diff --git a/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/tests/cases.yaml b/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/tests/cases.yaml
index ca7c3f6b7e28..7c9edd5ef71a 100644
--- a/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/tests/cases.yaml
+++ b/applications/openshift-virtualization/kubevirt-localnet-vlan-required/cel/tests/cases.yaml
@@ -75,3 +75,29 @@ cases:
             spec:
               config: '{"cniVersion": "0.3.1", "type": "ovn-k8s-cni-overlay", "topology":
                 "localnet", "netAttachDefName": "default/localnet-untagged"}'
+  - name: NAD with no spec at all is compliant (regression - istio-cni style)
+    expect: true
+    inputs:
+      nads:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: k8s.cni.cncf.io/v1
+            kind: NetworkAttachmentDefinition
+            metadata:
+              name: istio-cni
+              namespace: default
+  - name: NAD with an empty-string config is compliant (regression - parseJSON(""))
+    expect: true
+    inputs:
+      nads:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: k8s.cni.cncf.io/v1
+            kind: NetworkAttachmentDefinition
+            metadata:
+              name: empty-config
+              namespace: default
+            spec:
+              config: ""