Skip to content
OpenAdvisories
Critical · 9.2 CVE-2026-49445 BIT-cilium-2026-49445BIT-cilium-operator-2026-49445BIT-hubble-relay-2026-49445EUVD-2026-44772GHSA-3fcv-jvfp-m4q9GO-2026-5905

Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Published Jul 15, 2026 · Updated Jul 16, 2026 · Assigned by GitHub_M

Vendor: cilium Product: cilium Package: github.com/cilium/cilium Ecosystem: Go

Description

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

Affected products

VendorProductAffectedFixed
cilium cilium < 1.17.14, >= 1.18.0, < 1.18.8, >= 1.19.0, < 1.19.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kubeshark-cli 53.4.0-1.1 openSUSE-SU-2026:11519-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cilium/cilium >= 1.19.0, < 1.19.2 1.19.2 GHSA-3fcv-jvfp-m4q9
Go github.com/cilium/cilium >= 1.18.0, < 1.18.8 1.18.8 GHSA-3fcv-jvfp-m4q9
Go github.com/cilium/cilium < 1.17.14 1.17.14 GHSA-3fcv-jvfp-m4q9
Go github.com/cilium/cilium < 1.17.14 · >= 1.18.0, < 1.18.8 · >= 1.19.0, < 1.19.2 1.17.14, 1.18.8, 1.19.2 GO-2026-5905

Advisories 2

References