Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/cilium/ciliumCilium

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9GoAmendedPublished

    Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

    CVE-2026-56742 · GHSA-w7c2-w76w-5hmj

    Affected
    • Go github.com/cilium/ciliumCilium >= 1.18.0, < 1.18.11
    Fixed in
    1.18.11· Vendor fix available
    Issue
    Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects: Cilium v1.19 from v1.19.0 to v1.19.4 inclusive Cilium v1.18 from v1.18.0 to v1.18.10 inclusive All versions of Cilium before v1.17.17 This issue is patched in: Cilium v1.19.5 Cilium v1.18.11 Cilium v1.17.17 Workarounds There is no workaround to this issue. Users of this feature who are unable to upgrade can mitigate the risk by ensuring that RBAC permissions to create HTTPRoute objects are only granted to cluster admins. Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @galanko for reporting the issue and @mhofstetter for their work on triaging and remediating this issue. For more information If you have any…

    Recommended action: Upgrade to 1.18.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →