GO-2026-4856 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium...

EUVD-2026-16503

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the ciltocontainer and bpflxc local-backend packet path in the datapath components. An attacker can bypass ingress network policies and reach a local backend pod by sending traffic through an L7 load...

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

Impact Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments...

GHSA-HXV8-4J4R-CQGV Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

Impact Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments...

PT-2026-28513

Name of the Vulnerable Software and Affected Versions Cilium versions prior to 1.17.14 Cilium versions 1.18.0 through 1.18.7 Cilium versions 1.19.0 through 1.19.1 Description Cilium is a networking, observability, and security solution utilizing an eBPF-based dataplane. Ingress Network Policies a...

GHSA-P77J-4MVH-X3M3 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, sftpgo-plugin-kms, kube-vip, gatekeeper, kubeflow, apko, rabbitmq-messaging-topology-operator, kube-vip-cloud-provider, gitlab-pages, terraform-provider-grafana, policy-controller, temporal-ui-server,...

CVE-2026-33186 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, sftpgo-plugin-kms, kube-vip, gatekeeper, kubeflow, apko, rabbitmq-messaging-topology-operator, kube-vip-cloud-provider, gitlab-pages, terraform-provider-grafana, policy-controller, temporal-ui-server,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster-fips, yunikorn-k8shim-fips, wgcf, hydra-fips, kafkaexporter, zitadel, longhorn-cli, aws-application-networking-k8s, emqx-exporter-fips, cloud-provider-azure-fips, cue-fips, crossplane-provider-aws-dynamodb, gitlab-operator,...

SUSE CVE-2026-26963

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, kyverno, crossplane-provider-aws-memorydb, goreleaser, gitaly, vcluster, kyverno-notation-aws, apko, gptscript, ratify, src-fingerprint, policy-controller, skaffold, flux-notification-controller, rancher-fleet, lazygit,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, kyverno, crossplane-provider-aws-memorydb, goreleaser, gitaly, vcluster, kyverno-notation-aws, apko, gptscript, ratify, src-fingerprint, policy-controller, skaffold, flux-notification-controller, rancher-fleet, lazygit,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: kyverno-fips, cg, trivy, zot, argo-events-fips, hydra-fips, flux-kustomize-controller, crossplane-provider-azure-managedidentity, docker, omnictl-multiarch-fips, gitlab-operator, crossplane-provider-aws-dynamodb, kyverno-notation-aws-fips, scorecard,...

📄 Cilium 1.18.5 Traffic Bypass

This Python proof of concept script performs a comprehensive node-level analysis to assess a vulnerability in Cilium versions 1.18.0 through 1.18.5 that allows cross-node Pod traffic to bypass Host Firewall policies when Native Routing, WireGuard, and Node Encryption are enabled...

GO-2026-4522 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium

Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium...

Linux Distros Unpatched Vulnerability : CVE-2026-26963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from...

BIT-HUBBLE-RELAY-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6...

BIT-CILIUM-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6...

BIT-CILIUM-OPERATOR-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6...

CVE-2026-26963

A flaw was found in Cilium. When specific network configurations, including Native Routing, WireGuard, and Node Encryption, are enabled, Cilium incorrectly allows network traffic from Pods on other nodes. This can lead to unauthorized access to network communications and potential information...