CVE-2026-56742: Cilium authorization bypass in Gateway API HTTPRoute mirroring

CVE-2026-56742 · Severity: medium · CVSS 5.9 · Published 2026-07-15

Cilium, a networking and security tool for cloud environments, contains a vulnerability in its Gateway API implementation. Users with specific permissions to manage network routes could bypass security controls to mirror network traffic to unauthorized services across different namespaces. This could lead to unauthorized data observation or service interference, though the affected feature is disabled by default.

Technologies: Cilium, github.com/cilium/cilium (Go). Vendors: Cilium, Go.

Quick answers

Is CVE-2026-56742 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56742 being exploited in the wild.
How severe is CVE-2026-56742?
Medium severity, with a CVSS score of 5.9, published 15 July 2026.
Which products and versions are affected?
Cilium < 1.17.17, >= 1.18.0 < 1.18.11, >= 1.19.0 < 1.19.5; github.com/cilium/cilium (Go) SEMVER:introduced=0,fixed=1.17.17; github.com/cilium/ciliumCilium (Go) SEMVER:introduced=1.18.0,fixed=1.18.11.
Is there a fix for CVE-2026-56742?
Yes. github.com/cilium/cilium (Go): upgrade to 1.17.17 or later; github.com/cilium/ciliumCilium (Go): upgrade to 1.18.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56742 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-56742?
Check whether you run Cilium, github.com/cilium/cilium (Go) or github.com/cilium/ciliumCilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cilium/cilium (Go): upgrade to 1.17.17 or later
    go get github.com/cilium/cilium@v1.17.17
  • github.com/cilium/ciliumCilium (Go): upgrade to 1.18.11 or later
    go get github.com/cilium/ciliumCilium@v1.18.11

Technical details

A missing authorization check in Cilium's Gateway API implementation allows for a ReferenceGrant bypass. Specifically, the reconciliation logic failed to verify if cross-namespace backend references for request-mirror HTTP filters were permitted by an existing ReferenceGrant. An attacker with high privileges (ability to create/update HTTPRoutes) can exploit this to mirror traffic to services in other namespaces. The vulnerability is present in Cilium versions prior to 1.17.17, 1.18.11, and 1.19.5. Gateway API functionality must be enabled for a cluster to be vulnerable.

Affected products

  • Cilium Cilium < 1.17.17, >= 1.18.0 < 1.18.11, >= 1.19.0 < 1.19.5

Identifiers

  • CVE-2026-56742
  • BIT-CILIUM-2026-56742
  • BIT-CILIUM-OPERATOR-2026-56742
  • BIT-HUBBLE-RELAY-2026-56742
  • GHSA-w7c2-w76w-5hmj
  • GO-2026-6596

Timeline

  • 2026-07-15: advisory: NVD publication date
  • 2026-07-15: disclosed: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.