CVE-2026-56743: Cilium incorrect authorization in Kubernetes NetworkPolicy ipBlock rules

CVE-2026-56743 · Severity: medium · CVSS 5.4 · Published 2026-07-15

Cilium, a networking and security platform for Kubernetes clusters, contains a flaw in how it processes network policies that use IP-based (CIDR) rules without pod or namespace selectors. When a cluster is configured with a custom cluster name, the affected versions incorrectly allow traffic between pods in the same namespace, bypassing the intended CIDR-only restriction. This could allow unauthorized lateral movement of traffic within a Kubernetes namespace.

Technologies: Cilium, github.com/cilium/cilium (Go). Vendors: Cilium, Go.

Quick answers

Is CVE-2026-56743 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56743 being exploited in the wild.
How severe is CVE-2026-56743?
Medium severity, with a CVSS score of 5.4, published 15 July 2026.
Which products and versions are affected?
Cilium 1.19.0 to 1.19.4; github.com/cilium/cilium (Go) >= 1.19.0, < 1.19.5, SEMVER:introduced=1.19.0,fixed=1.19.5.
Is there a fix for CVE-2026-56743?
Yes. github.com/cilium/cilium (Go): upgrade to 1.19.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56743 attacked?
It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-56743?
Check whether you run Cilium or github.com/cilium/cilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cilium/cilium (Go): upgrade to 1.19.5 or later
    go get github.com/cilium/cilium@v1.19.5

Technical details

Cilium's Kubernetes NetworkPolicy parser contains an incorrect authorization flaw (CWE-863) when processing selectorless ipBlock peers. The vulnerability occurs when Cilium is deployed with a custom clusterName (rather than the default "any" value). In this configuration, the parseNetworkPolicyPeer function incorrectly instantiates a pod selector for policies that only specify ipBlock rules without pod or namespace selectors. This causes Cilium to append an unintended wildcard namespace label selector to the Layer 3 allow rules, effectively allowing traffic from any pod in the same namespace as the policy target. The attack requires adjacent network access and low privileges, affecting only v1.19.0 through v1.19.4. The fix (v1.19.5) returns early when both PodSelector and NamespaceSelector are nil, preventing the erroneous selector instantiation. Versions below v1.19.0 are not affected.

Affected products

  • Cilium Cilium 1.19.0 through 1.19.4

Identifiers

  • CVE-2026-56743
  • GHSA-fm8w-2m5w-9j7r
  • GO-2026-6367

Timeline

  • 2026-07-06: disclosed: Advisory published by Cilium security team
  • 2026-06-10: patched: Fix merged to v1.19 branch; v1.19.5 released
  • 2026-09-03: advisory: GitHub Advisory Database published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.