Junglewise Threat Intelligence

CVE-2026-49445: Cilium world-accessible Envoy admin socket on cluster nodes

CVE-2026-49445 · Severity: critical · CVSS 9.2 · Published 2026-07-15

Technologies: github.com/cilium/cilium (Go), Cilium. Vendors: Go, Cilium.

Executive brief

Cilium is a networking and security platform used to manage communication between applications in cloud environments. A security flaw was discovered where a critical internal control component (Envoy) was accessible to any user on the underlying server. An attacker with local access could exploit this to steal encryption keys, disrupt network traffic, or shut down networking services, potentially leading to a complete cluster compromise.

Technical details

A vulnerability exists in Cilium where the embedded or standalone Envoy instance creates a Unix domain socket (admin.sock) with world-accessible permissions (mode 0777) instead of restricted permissions. This occurs when Cilium L7 functionality is enabled. A local attacker on a cluster node can connect to this socket to access Envoy's administrative endpoints without authentication. This access allows for the extraction of sensitive TLS secrets, modification of Envoy configurations, disruption of cluster traffic, or termination of the Envoy process. The fix explicitly sets the socket mode to 0660.

Affected products

  • Cilium Cilium < 1.17.14, >= 1.18.0 < 1.18.8, >= 1.19.0 < 1.19.2

Timeline

  • 2026-07-15: advisory: NVD publication date
  • 2026-02-26: patched: Fix merged into main branch

References

Related threats