CVE-2026-56743
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.
Risk Assessment
The organization may face unauthorized access to resources within the same namespace, violating network security policy assumptions and potentially leading to data breaches or lateral attacks.
Recommendation
Immediately upgrade Cilium to version 1.19.5 or later, which includes a fix that prevents incorrect rule generation for selectorless peer definitions.
Other vulnerabilities in Cilium
See all- CVE-2026-41520High
Cilium, a networking, observability, and security solution, prior to versions 1.17.15, 1.18.9, and 1.19.3, could output sensitive data when the cilium-bugtool was run against deployments with WireGuard encryption enabled.
- CVE-2026-49445Critical
In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.
- CVE-2026-56742Medium
A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.
- CVE-2026-53935Medium
A vulnerability in Cilium allows users with the ability to create CiliumLocalRedirectPolicies to hijack traffic to Services in any namespace by specifying arbitrary ClusterIPs via addressMatcher. Deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service.
- CVE-2023-34242Low
Cilium, a networking, observability, and security solution, prior to version 1.13.4 had a vulnerability that allowed unintended access to secrets and services across namespaces when Gateway API was enabled. The lack of namespace checks when creating ReferenceGrant allowed attackers to use secrets that should not be visible to them.
Original NVD description (English source)
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.