CVE-2026-49445
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.
Risk Assessment
The risk for the organization includes potential exposure of sensitive data (TLS secrets) and the ability to disrupt cluster operations, potentially leading to service outages and security breaches.
Recommendation
It is recommended to immediately upgrade Cilium to versions 1.17.14, 1.18.8, or 1.19.2, which contain the fix for this vulnerability.
Original NVD description (English source)
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.