Incorrect authorization in Cilium - CVE-2026-33726
Published: November 9, 2026
Vulnerability identifier: #VU162612
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33726
CWE-ID: CWE-863
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent-network attacker with low privileges to bypass Kubernetes ingress NetworkPolicy restrictions in Cilium.
The vulnerability exists due to missing ingress policy enforcement for pod traffic through Cilium's L7 proxy to same-node backends when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. An adjacent-network attacker with low privileges can send traffic from a pod to an L7 Service with a backend on the same node and reach otherwise restricted workloads.
Affected software
Cilium
How to mitigate CVE-2026-33726
Install security update from vendor's website.
Cilium - addressed in versions 1.17.14, 1.18.8, 1.19.2