tetragon

Cilium’s new Tetragon component enables powerful real-time, eBPF-based Security Observability and Runtime Enforcement. Tetragon detects and is able to react to security-significant events, such as Process execution events System call activity I/O activity including network & file access When used...

cilium

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span...

hardening-k8s-containers

Intentionally Vulnerable Note Taking Application This repository contains a very simple and vulnerable application used to demonstrate the differences between deploying this application with the default settings to a Kubernetes cluster, versus adding some extra security settings that WILL NOT fix...

cilium

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium ist eine Netzwerk-, Observability- und Sicherheitslösung mit einer eBPF-basierten Datenebene. Es bietet ein einfaches flaches Layer-3-Netzwerk mit der...

CLEANSTART-2026-KZ38920 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the buildkitd package. A vulnerability has been found in cilium ebpf up to 0...

GO-2026-6505 vulnerabilities

Vulnerabilities for packages: terraform, kube-state-metrics, rekor, rancher, grype, step-issuer, step, net-kourier, cert-manager-csi-driver, descheduler, flux-helm-controller, kyverno-notation-aws, fulcio, kubernetes-csi-node-driver-registrar, k9s, kubescape-operator, prometheus-adapter, docker,...

GO-2026-6596 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium...

PT-2026-105612

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CLEANSTART-2026-CI21288 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

PT-2026-108365

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects...

EUVD-2026-44773

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces...

GHSA-W7C2-W76W-5HMJ Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects...

SUSE CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

cilium v1.20.2

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...

Amazon Linux 2 : nerdctl (ALAS-2026-3903)

The version of nerdctl installed on the remote host is prior to 2.3.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3903 advisory. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go o...

Medium: nerdctl

Issue Overview: A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be...

GO-2026-6367 vulnerabilities

Vulnerabilities for packages: kubescape, cilium...

GO-2026-6367 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium...