Incorrect authorization in Cilium - CVE-2026-104149
Published: November 9, 2026
Vulnerability identifier: #VU162618
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-104149
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass Cilium ingress host policies and L7 network policies to reach protected pods.
The vulnerability exists due to incorrect packet classification that skips policy enforcement when TCX attachment is enabled and Cilium attaches to both a VLAN interface and its parent. An unauthenticated remote attacker can send traffic from outside an affected node to targeted pods and establish connections that those policies should deny.
Affected software
Cilium
How to mitigate CVE-2026-104149
Install security update from vendor's website.
Cilium - addressed in versions 1.17.15, 1.18.9