Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-56742 BIT-cilium-2026-56742BIT-cilium-operator-2026-56742BIT-hubble-relay-2026-56742EUVD-2026-44773GHSA-w7c2-w76w-5hmjGO-2026-6596

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Published Jul 15, 2026 · Updated Jul 16, 2026 · Assigned by GitHub_M

Vendor: cilium Product: cilium Package: cilium-1.19-operator-generic Package: github.com/cilium/cilium Package: github.com/cilium/ciliumCilium Package: hubble Package: hubble-ui-backend Package: kubescape Package: kubescape-operator Ecosystem: Go Ecosystem: Wolfi

Description

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

Affected products

VendorProductAffectedFixed
cilium cilium < 1.17.17, >= 1.18.0, < 1.18.11, >= 1.19.0, < 1.19.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cilium-1.19-operator-generic 1.19.7-r7 —
Wolfi rolling hubble 1.19.4-r6 —
Wolfi rolling hubble-ui-backend 0.13.5-r11 —
Wolfi rolling kubescape 4.0.10-r8 —
Wolfi rolling kubescape-operator 0.2.151-r7 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cilium/cilium < 1.17.17 1.17.17 GHSA-w7c2-w76w-5hmj
Go github.com/cilium/cilium >= 1.19.0, < 1.19.5 1.19.5 GHSA-w7c2-w76w-5hmj
Go github.com/cilium/cilium < 1.17.17 · >= 1.18.0, < 1.18.11 · >= 1.19.0, < 1.19.5 1.17.17, 1.18.11, 1.19.5 GO-2026-6596
Go github.com/cilium/ciliumCilium >= 1.18.0, < 1.18.11 1.18.11 GHSA-w7c2-w76w-5hmj

References