Executive brief
Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium
Affected products
- Go github.com/cilium/cilium
Junglewise Threat Intelligence
CVE-2026-26963: GO-2026-4522 - Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium
CVE-2026-26963 · Severity: low · CVSS 3.1 · Published 2026-02-23
Technologies: github.com/cilium/cilium (Go). Vendors: Go.
Related threats
- Cilium incorrect authorization in Kubernetes NetworkPolicy ipBlock rules
- Cilium world-accessible Envoy admin socket on cluster nodes
- Cilium traffic hijacking via CiliumLocalRedirectPolicy addressMatcher
- Cilium sensitive information disclosure in cilium-bugtool
- GO-2026-4856 - Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium