CVE-2026-56742Medium· 5.9▾ SunlitCilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any S…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
cilium < 1.17.17cilium >= 1.18.0, < 1.18.11cilium >= 1.19.0, < 1.19.5Upgrade past the affected range:
cilium 1.19.5Affected packages:
github.com/cilium/cilium < 1.17.17github.com/cilium/ciliumCilium >= 1.18.0, < 1.18.11github.com/cilium/cilium >= 1.19.0, < 1.19.5Patched in:
github.com/cilium/cilium 1.17.17github.com/cilium/ciliumCilium 1.18.11github.com/cilium/cilium 1.19.5Connected by shared product, vendor, weakness, or advisory.
CVE-2024-25630Medium· 6.1Unencrypted ingress/health traffic when using Wireguard transparent encryption
CVE-2024-28248High· 7.2Intermittent HTTP policy bypass
CVE-2025-32793Medium· 4.0In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
CVE-2023-41333Medium· 6.9Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy
CVE-2023-27593Medium· 4.4cilium-agent container can access the host via `hostPath` mount
CVE-2024-47825Medium· 4.0Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present