CVE-2026-53935
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in Cilium allows users with the ability to create CiliumLocalRedirectPolicies to hijack traffic to Services in any namespace by specifying arbitrary ClusterIPs via addressMatcher. Deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service.
Risk Assessment
The organization is at risk of unauthorized traffic interception between services, potentially leading to data leaks, man-in-the-middle attacks, or service disruption. Additionally, deleting a malicious policy can permanently damage service translation, causing availability issues.
Recommendation
Immediately upgrade Cilium to version 1.17.16, 1.18.10, or 1.19.4 depending on the branch in use. Restrict permissions to create CiliumLocalRedirectPolicies to trusted users only.
Other vulnerabilities in Cilium
See all- CVE-2026-41520High
Cilium, a networking, observability, and security solution, prior to versions 1.17.15, 1.18.9, and 1.19.3, could output sensitive data when the cilium-bugtool was run against deployments with WireGuard encryption enabled.
- CVE-2026-49445Critical
In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.
- CVE-2026-56743Medium
A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.
- CVE-2026-56742Medium
A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.
- CVE-2023-34242Low
Cilium, a networking, observability, and security solution, prior to version 1.13.4 had a vulnerability that allowed unintended access to secrets and services across namespaces when Gateway API was enabled. The lack of namespace checks when creating ReferenceGrant allowed attackers to use secrets that should not be visible to them.
Original NVD description (English source)
Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.