Executive brief
Cilium is a networking and security tool used to manage traffic between applications in cloud environments like Kubernetes. A vulnerability was found where users with specific permissions could redirect network traffic intended for one application to a different, unauthorized destination. This could allow an attacker to intercept sensitive data or cause a service outage by corrupting the internal networking state.
Technical details
An authorization bypass exists in Cilium's Local Redirect Policy (LRP) implementation. When using the 'addressMatcher' configuration, the LRP controller fails to properly validate if a target ClusterIP is already owned by another Service. This allows a high-privileged user in one namespace to hijack traffic intended for a Service in a different namespace by overwriting the ClusterIP entry in the Cilium service map. Furthermore, deleting the malicious policy does not restore the original service map entry, leading to a denial-of-service condition for the affected Service. The issue was caused by a logic error where an unconditional 'DeleteFrontend' operation cleared the frontend before a guard check could inspect it. Patches are available in versions 1.17.16, 1.18.10, and 1.19.4.
Affected products
- Cilium Cilium < 1.17.16, 1.18.2 - 1.18.9, 1.19.0 - 1.19.3
Timeline
- 2026-07-07: advisory: NVD publication date
- 2026-04-21: patched: Fix merged for v1.17 branch
- 2026-04-24: patched: Fix merged for v1.19 branch
References
- https://github.com/cilium/cilium/commit/81d446395673dc2c684c047c12715caffac1a351
- https://github.com/cilium/cilium/commit/92ca32eda85aa0c7611c28221cc26fa08be17ebc
- https://github.com/cilium/cilium/commit/fe7eb53c7aac9fa7ec610b1975d73fbbb198c66d
- https://github.com/cilium/cilium/pull/45412
- https://github.com/cilium/cilium/pull/45584
- https://github.com/cilium/cilium/pull/45585
- https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x