Path traversal in Cilium - #VU162619
Published: November 9, 2026
Vulnerability identifier: #VU162619
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent-network attacker with low privileges to disclose local file contents outside Cilium's configured certificates directory.
The vulnerability exists due to path traversal in the secret.name field of CiliumNetworkPolicy HTTP L7 header matches using mismatch: REPLACE. An adjacent-network attacker with low privileges can use CiliumNetworkPolicy creation or modification permissions to reference a directory containing exactly one file readable by cilium-agent, causing its contents to be included in an HTTP header.
Affected software
Cilium
Remediation
Install security update from vendor's website.
Cilium - addressed in versions 1.18.14, 1.19.8, 1.20.2