GO-2023-2412 vulnerabilities

Vulnerabilities for packages: kaniko, melange, buildkitd, skaffold, trivy, up, helm, cilium-cli, flux-helm-controller, zot, k8sgpt, kubescape, gitness, grype, fuse-overlayfs-snapshotter, newrelic-infrastructure-agent, helm-push, k3d, ctop, kots, flux-source-controller, kubevela, eksctl...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: linkerd2, chartmuseum, k9s, rancher-helm, cerbos, kargo, chart-testing, trivy, tw, envoy-gateway, cilium-cli, flux-helm-controller, zot, pluto, rancher-fleet, cluster-api-helm-controller, k8sgpt, cert-manager-cmctl, helm-operator, k8ssandra-client, helm-push, istio,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: kaniko, melange, buildkitd, cadvisor, kargo, dagger, trivy, syft, up, cilium-cli, tkn, zot, spire-server, kubescape, grype, conftest, aactl, buf, ctop, crossplane, ko, docker-compose, wolfictl...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, scorecard, rancher-agent, sops, crossplane-provider-azure-authorization, nerdctl, traefik, gh, src, cilium-cli, chezmoi, crossplane-provider-azure-storage, crossplane-provider-aws-ec2, fulcio, pulumi-language-java,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, hubble, kor, src, kapp-controller, cilium-cli, docker-credential-gcr, terraform-mcp-server, nodetaint, fulcio, cni-plugins, nova, migrate, docker-machine-driver-harvester, dgraph, portieris, kuberlr, nri-redis, clickhouse-operator,...

OPENSUSE-SU-2026:21574-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267794. Other...

SUSE-SU-2026:23234-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267794. Other...

SUSE CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

SUSE CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespa...

CLEANSTART-2026-YQ65927 Security fixes in cilium 1.19.3-r0

Package cilium version 1.19.3-r0 fixes 22 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-27143, CVE-2026-27144, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-YO06374 Security fixes in cilium 1.18.9-r0

Package cilium version 1.18.9-r0 fixes 22 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-27143, CVE-2026-27144, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-EC81724 Security fixes in cilium 1.18.5-r0

Package cilium version 1.18.5-r0 fixes 5 vulnerabilities: CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-68119...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:21442-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21442-1 advisory. This update for alloy fixes the following issue: Update to version 1.17.1. Security issue fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger...

BIT-HUBBLE-RELAY-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

BIT-HUBBLE-RELAY-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...

BIT-HUBBLE-RELAY-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

BIT-CILIUM-OPERATOR-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

BIT-CILIUM-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

BIT-CILIUM-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...

BIT-CILIUM-OPERATOR-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...