# CVE-2026-53935: Cilium traffic hijacking via CiliumLocalRedirectPolicy addressMatcher Source: https://junglewise.ai/threats/cve-2026-53935-cilium-traffic-hijacking-via-ciliumlocalredirectpolicy Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-07-07. Updated: 2026-07-07 License: CC BY 4.0 with a link back CVE-2026-53935 · Severity: medium · CVSS 6.9 · Published 2026-07-07 Cilium is a networking and security tool used to manage traffic between applications in cloud environments like Kubernetes. A vulnerability was found where users with specific permissions could redirect network traffic intended for one application to a different, unauthorized destination. This could allow an attacker to intercept sensitive data or cause a service outage by corrupting the internal networking state. Technologies: [Cilium](https://junglewise.ai/threats/technologies/cilium), [github.com/cilium/cilium (Go)](https://junglewise.ai/threats/technologies/github-com-cilium-cilium). Vendors: [Cilium](https://junglewise.ai/threats/vendors/cilium), [Go](https://junglewise.ai/threats/vendors/go). ## Quick answers **Is CVE-2026-53935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53935 being exploited in the wild. **How severe is CVE-2026-53935?** Medium severity, with a CVSS score of 6.9, published 7 July 2026. **Which products and versions are affected?** Cilium < 1.17.16, 1.18.2 - 1.18.9, 1.19.0 - 1.19.3, >= 1.19.0, < 1.19.4; >= 1.18.2, < 1.18.10; < 1.17.16; github.com/cilium/cilium (Go) SEMVER:introduced=0,fixed=1.17.16,introduced=1.18.2,fixed=1.18.10,introduced=1.19.0,fixed=1.19.4, SEMVER:introduced=1.19.0,fixed=1.19.4. **Is there a fix for CVE-2026-53935?** Yes. github.com/cilium/cilium (Go): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-53935 attacked?** It is attacked from the adjacent network, in a software library. **Am I affected by CVE-2026-53935?** Check whether you run Cilium or github.com/cilium/cilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/cilium/cilium (Go): upgrade to 1.19.4 or later ```sh go get github.com/cilium/cilium@v1.19.4 ``` ## Technical details An authorization bypass exists in Cilium's Local Redirect Policy (LRP) implementation. When using the 'addressMatcher' configuration, the LRP controller fails to properly validate if a target ClusterIP is already owned by another Service. This allows a high-privileged user in one namespace to hijack traffic intended for a Service in a different namespace by overwriting the ClusterIP entry in the Cilium service map. Furthermore, deleting the malicious policy does not restore the original service map entry, leading to a denial-of-service condition for the affected Service. The issue was caused by a logic error where an unconditional 'DeleteFrontend' operation cleared the frontend before a guard check could inspect it. Patches are available in versions 1.17.16, 1.18.10, and 1.19.4. ## Affected products - Cilium Cilium < 1.17.16, 1.18.2 - 1.18.9, 1.19.0 - 1.19.3 ## Identifiers - CVE-2026-53935 - GHSA-q6h5-q3q6-f87x - GO-2026-5914 ## Timeline - 2026-07-07: advisory: NVD publication date - 2026-04-21: patched: Fix merged for v1.17 branch - 2026-04-24: patched: Fix merged for v1.19 branch ## References - [https://github.com/cilium/cilium/commit/81d446395673dc2c684c047c12715caffac1a351](https://github.com/cilium/cilium/commit/81d446395673dc2c684c047c12715caffac1a351) - [https://github.com/cilium/cilium/commit/92ca32eda85aa0c7611c28221cc26fa08be17ebc](https://github.com/cilium/cilium/commit/92ca32eda85aa0c7611c28221cc26fa08be17ebc) - [https://github.com/cilium/cilium/commit/fe7eb53c7aac9fa7ec610b1975d73fbbb198c66d](https://github.com/cilium/cilium/commit/fe7eb53c7aac9fa7ec610b1975d73fbbb198c66d) - [https://github.com/cilium/cilium/pull/45412](https://github.com/cilium/cilium/pull/45412) - [https://github.com/cilium/cilium/pull/45584](https://github.com/cilium/cilium/pull/45584) - [https://github.com/cilium/cilium/pull/45585](https://github.com/cilium/cilium/pull/45585) - [https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x](https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x) ## Related threats - [Cilium incorrect authorization in Kubernetes NetworkPolicy ipBlock rules](https://junglewise.ai/threats/cve-2026-56743-cilium-incorrect-authorization-in-kubernetes-networkpolicy) - [Cilium authorization bypass in Gateway API HTTPRoute mirroring](https://junglewise.ai/threats/cve-2026-56742-cilium-authorization-bypass-in-gateway-api-httproute-mirroring) - [Cilium world-accessible Envoy admin socket on cluster nodes](https://junglewise.ai/threats/cve-2026-49445-cilium-world-accessible-envoy-admin-socket-on-cluster-nodes) - [Cilium sensitive information disclosure in cilium-bugtool](https://junglewise.ai/threats/cve-2026-41520-cilium-sensitive-information-disclosure-in-cilium-bugtool) - [GO-2026-4856 - Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium](https://junglewise.ai/threats/cve-2026-33726-cilium-l7-proxy-may-bypass-kubernetes-networkpolicy-for-same-node)