SB2026110946 - Multiple vulnerabilities in Cilium

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: CVE-2026-33726)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an adjacent-network attacker with low privileges to bypass Kubernetes ingress NetworkPolicy restrictions in Cilium.

The vulnerability exists due to missing ingress policy enforcement for pod traffic through Cilium's L7 proxy to same-node backends when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. An adjacent-network attacker with low privileges can send traffic from a pod to an L7 Service with a backend on the same node and reach otherwise restricted workloads.

2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-49445)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to expose sensitive information or disrupt cluster traffic in Cilium.

The vulnerability exists due to a world-accessible Envoy administration socket created on cluster nodes when Cilium L7 functionality is enabled. An unprivileged local attacker can access administrative endpoints through this socket to retrieve TLS secrets or terminate Envoy, depending on the deployment configuration.

Remediation

Install update from vendor's website.

References

• https://github.com/cilium/cilium/security/advisories/GHSA-hxv8-4j4r-cqgv
• https://github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9