CVE-2026-56742

Published: Jul 15, 2026Modified: Jul 17, 2026

8.9

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Exploitability: 2.3 / Impact: 6.0

Source: NVD

Description

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

Affected (3)

Products: Cilium: Cilium

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cilium Cilium	Before 1.17.17
Cilium Cilium	From 1.18.0 to 1.18.11
Cilium Cilium	From 1.19.0 to 1.19.5

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (8)

https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb

Source: security-advisories@github.com

Patch

https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857

Source: security-advisories@github.com

Patch

https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b

Source: security-advisories@github.com

Patch

https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca

Source: security-advisories@github.com

Patch

https://github.com/cilium/cilium/releases/tag/v1.17.17

Source: security-advisories@github.com

Release Notes

https://github.com/cilium/cilium/releases/tag/v1.18.11

Source: security-advisories@github.com

Release Notes

https://github.com/cilium/cilium/releases/tag/v1.19.5

Source: security-advisories@github.com

Release Notes

https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.