cilium

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span...

tetragon

Cilium’s new Tetragon component enables powerful real-time, eBPF-based Security Observability and Runtime Enforcement. Tetragon detects and is able to react to security-significant events, such as Process execution events System call activity I/O activity including network & file access When used...

hardening-k8s-containers

Intentionally Vulnerable Note Taking Application This repository contains a very simple and vulnerable application used to demonstrate the differences between deploying this application with the default settings to a Kubernetes cluster, versus adding some extra security settings that WILL NOT fix...

CVE-2026-63209 vulnerabilities

Vulnerabilities for packages: kots, commercial-kyverno, telegraf, flux, upwind-agent, cert-manager, commercial-expanso-edge, omnictl-multiarch, kine, nerdctl, zot, omnictl-multiarch-fips, kaf, commercial-grafana, spire-server, helm, elastic-agent-fips, prometheus-mongodb-exporter, k3d, kyverno,...

CVE-2026-83620

Impact In a Cilium cluster with mutual authentication enabled, an attacker with any valid client certificate can completely bypass mutual authentication and impersonate any other identity in the cluster. This occurs if they obtain the public certificate of the target identity and append it to the...

CVE-2026-77531

Impact In a cluster with "SDS" https://docs.cilium.io/en/stable/security/tls-visibility/secret-discovery-service-sds enabled for L7 network policies, an attacker may be able to affect policy enforcement behaviour by exploiting name collisions between synced Secret and ConfigMap objects. A...

CVE-2026-104149

Impact On nodes using VLAN interfaces, Cilium may fail to enforce ingress host policies and L7 network policies for connections from outside the node. Only nodes on which Cilium is attached to both a VLAN interface and its parent are affected. Cilium TCX attachment must also be enabled, as is the...

cilium

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium ist eine Netzwerk-, Observability- und Sicherheitslösung mit einer eBPF-basierten Datenebene. Es bietet ein einfaches flaches Layer-3-Netzwerk mit der...

CLEANSTART-2026-KZ38920 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the buildkitd package. A vulnerability has been found in cilium ebpf up to 0...

GO-2026-6505 vulnerabilities

Vulnerabilities for packages: trivy-operator, tekton-pipelines, k3s, harbor-registry, distribution, gomplate, grafana-operator, linkerd2, prometheus-alertmanager, flux-notification-controller, argocd-image-updater, k8sgpt, cluster-api-azure-controller, flux-source-controller, clickhouse-operator,...

GO-2026-6596 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium...

PT-2026-105612

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CLEANSTART-2026-CI21288 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

PT-2026-108365

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

GHSA-W7C2-W76W-5HMJ Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects...

EUVD-2026-44773

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces...

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Impact In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. Patches This issue affects...

SUSE CVE-2026-56743

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

cilium v1.20.2

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...