CVE-2026-41520
HighSummary
Cilium, a networking, observability, and security solution, prior to versions 1.17.15, 1.18.9, and 1.19.3, could output sensitive data when the cilium-bugtool was run against deployments with WireGuard encryption enabled.
Risk Assessment
Organizations may be exposed to the disclosure of confidential information, potentially leading to privacy breaches and data security issues.
Recommendation
It is recommended to upgrade to versions 1.17.15, 1.18.9, or 1.19.3 to mitigate this vulnerability.
Other vulnerabilities in Cilium
See all- CVE-2026-49445Critical
In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.
- CVE-2026-56743Medium
A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.
- CVE-2026-56742Medium
A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.
- CVE-2026-53935Medium
A vulnerability in Cilium allows users with the ability to create CiliumLocalRedirectPolicies to hijack traffic to Services in any namespace by specifying arbitrary ClusterIPs via addressMatcher. Deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service.
- CVE-2023-34242Low
Cilium, a networking, observability, and security solution, prior to version 1.13.4 had a vulnerability that allowed unintended access to secrets and services across namespaces when Gateway API was enabled. The lack of namespace checks when creating ReferenceGrant allowed attackers to use secrets that should not be visible to them.
Original NVD description (English source)
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.