CVE-2026-53935: Cilium traffic hijacking via CiliumLocalRedirectPolicy addressMatcher

CVE-2026-53935 · Severity: medium · CVSS 6.9 · Published 2026-07-07

Cilium is a networking and security tool used to manage traffic between applications in cloud environments like Kubernetes. A vulnerability was found where users with specific permissions could redirect network traffic intended for one application to a different, unauthorized destination. This could allow an attacker to intercept sensitive data or cause a service outage by corrupting the internal networking state.

Technologies: Cilium, github.com/cilium/cilium (Go). Vendors: Cilium, Go.

Quick answers

Is CVE-2026-53935 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53935 being exploited in the wild.
How severe is CVE-2026-53935?
Medium severity, with a CVSS score of 6.9, published 7 July 2026.
Which products and versions are affected?
Cilium < 1.17.16, 1.18.2 - 1.18.9, 1.19.0 - 1.19.3, >= 1.19.0, < 1.19.4; >= 1.18.2, < 1.18.10; < 1.17.16; github.com/cilium/cilium (Go) SEMVER:introduced=0,fixed=1.17.16,introduced=1.18.2,fixed=1.18.10,introduced=1.19.0,fixed=1.19.4, SEMVER:introduced=1.19.0,fixed=1.19.4.
Is there a fix for CVE-2026-53935?
Yes. github.com/cilium/cilium (Go): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53935 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-53935?
Check whether you run Cilium or github.com/cilium/cilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cilium/cilium (Go): upgrade to 1.19.4 or later
    go get github.com/cilium/cilium@v1.19.4

Technical details

An authorization bypass exists in Cilium's Local Redirect Policy (LRP) implementation. When using the 'addressMatcher' configuration, the LRP controller fails to properly validate if a target ClusterIP is already owned by another Service. This allows a high-privileged user in one namespace to hijack traffic intended for a Service in a different namespace by overwriting the ClusterIP entry in the Cilium service map. Furthermore, deleting the malicious policy does not restore the original service map entry, leading to a denial-of-service condition for the affected Service. The issue was caused by a logic error where an unconditional 'DeleteFrontend' operation cleared the frontend before a guard check could inspect it. Patches are available in versions 1.17.16, 1.18.10, and 1.19.4.

Affected products

  • Cilium Cilium < 1.17.16, 1.18.2 - 1.18.9, 1.19.0 - 1.19.3

Identifiers

  • CVE-2026-53935
  • GHSA-q6h5-q3q6-f87x
  • GO-2026-5914

Timeline

  • 2026-07-07: advisory: NVD publication date
  • 2026-04-21: patched: Fix merged for v1.17 branch
  • 2026-04-24: patched: Fix merged for v1.19 branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.