# CVE-2026-56742: Cilium authorization bypass in Gateway API HTTPRoute mirroring

Source: https://junglewise.ai/threats/cve-2026-56742-cilium-authorization-bypass-in-gateway-api-httproute-mirroring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-56742 · Severity: medium · CVSS 5.9 · Published 2026-07-15

Cilium, a networking and security tool for cloud environments, contains a vulnerability in its Gateway API implementation. Users with specific permissions to manage network routes could bypass security controls to mirror network traffic to unauthorized services across different namespaces. This could lead to unauthorized data observation or service interference, though the affected feature is disabled by default.

Technologies: [Cilium](https://junglewise.ai/threats/technologies/cilium), [github.com/cilium/cilium (Go)](https://junglewise.ai/threats/technologies/github-com-cilium-cilium). Vendors: [Cilium](https://junglewise.ai/threats/vendors/cilium), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-56742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56742 being exploited in the wild.

**How severe is CVE-2026-56742?** Medium severity, with a CVSS score of 5.9, published 15 July 2026.

**Which products and versions are affected?** Cilium < 1.17.17, >= 1.18.0 < 1.18.11, >= 1.19.0 < 1.19.5; github.com/cilium/cilium (Go) SEMVER:introduced=0,fixed=1.17.17; github.com/cilium/ciliumCilium (Go) SEMVER:introduced=1.18.0,fixed=1.18.11.

**Is there a fix for CVE-2026-56742?** Yes. github.com/cilium/cilium (Go): upgrade to 1.17.17 or later; github.com/cilium/ciliumCilium (Go): upgrade to 1.18.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56742 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-56742?** Check whether you run Cilium, github.com/cilium/cilium (Go) or github.com/cilium/ciliumCilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cilium/cilium (Go): upgrade to 1.17.17 or later

  ```sh
  go get github.com/cilium/cilium@v1.17.17
  ```

- github.com/cilium/ciliumCilium (Go): upgrade to 1.18.11 or later

  ```sh
  go get github.com/cilium/ciliumCilium@v1.18.11
  ```


## Technical details

A missing authorization check in Cilium's Gateway API implementation allows for a ReferenceGrant bypass. Specifically, the reconciliation logic failed to verify if cross-namespace backend references for request-mirror HTTP filters were permitted by an existing ReferenceGrant. An attacker with high privileges (ability to create/update HTTPRoutes) can exploit this to mirror traffic to services in other namespaces. The vulnerability is present in Cilium versions prior to 1.17.17, 1.18.11, and 1.19.5. Gateway API functionality must be enabled for a cluster to be vulnerable.

## Affected products

- Cilium Cilium < 1.17.17, >= 1.18.0 < 1.18.11, >= 1.19.0 < 1.19.5

## Identifiers

- CVE-2026-56742
- BIT-CILIUM-2026-56742
- BIT-CILIUM-OPERATOR-2026-56742
- BIT-HUBBLE-RELAY-2026-56742
- GHSA-w7c2-w76w-5hmj
- GO-2026-6596

## Timeline

- 2026-07-15: advisory: NVD publication date
- 2026-07-15: disclosed: GitHub Security Advisory published

## References

- [https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb](https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb)
- [https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857](https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857)
- [https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b](https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b)
- [https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca](https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca)
- [https://github.com/cilium/cilium/releases/tag/v1.17.17](https://github.com/cilium/cilium/releases/tag/v1.17.17)
- [https://github.com/cilium/cilium/releases/tag/v1.18.11](https://github.com/cilium/cilium/releases/tag/v1.18.11)
- [https://github.com/cilium/cilium/releases/tag/v1.19.5](https://github.com/cilium/cilium/releases/tag/v1.19.5)

## Related threats

- [Cilium incorrect authorization in Kubernetes NetworkPolicy ipBlock rules](https://junglewise.ai/threats/cve-2026-56743-cilium-incorrect-authorization-in-kubernetes-networkpolicy)
- [Cilium world-accessible Envoy admin socket on cluster nodes](https://junglewise.ai/threats/cve-2026-49445-cilium-world-accessible-envoy-admin-socket-on-cluster-nodes)
- [Cilium traffic hijacking via CiliumLocalRedirectPolicy addressMatcher](https://junglewise.ai/threats/cve-2026-53935-cilium-traffic-hijacking-via-ciliumlocalredirectpolicy)
- [Cilium sensitive information disclosure in cilium-bugtool](https://junglewise.ai/threats/cve-2026-41520-cilium-sensitive-information-disclosure-in-cilium-bugtool)
- [GO-2026-4856 - Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium](https://junglewise.ai/threats/cve-2026-33726-cilium-l7-proxy-may-bypass-kubernetes-networkpolicy-for-same-node)