SB2026110947 - Incorrect authorization in Cilium

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110947

SB2026110947 - Incorrect authorization in Cilium

Published: November 9, 2026

Security Bulletin ID SB2026110947
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: CVE-2026-53935)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a privileged adjacent-network attacker with permission to create CiliumLocalRedirectPolicies to hijack traffic destined for Services in any namespace.

The vulnerability exists due to missing namespace restrictions on the addressMatcher configuration in CiliumLocalRedirectPolicy when an arbitrary ClusterIP is specified. A privileged adjacent-network attacker can create a policy targeting another namespace's Service ClusterIP to redirect its traffic, bypassing the namespace isolation enforced by serviceMatcher.


Remediation

Install update from vendor's website.

References