Executive brief
Cilium, a networking and security platform for Kubernetes clusters, contains a flaw in how it processes network policies that use IP-based (CIDR) rules without pod or namespace selectors. When a cluster is configured with a custom cluster name, the affected versions incorrectly allow traffic between pods in the same namespace, bypassing the intended CIDR-only restriction. This could allow unauthorized lateral movement of traffic within a Kubernetes namespace.
Technical details
Cilium's Kubernetes NetworkPolicy parser contains an incorrect authorization flaw (CWE-863) when processing selectorless ipBlock peers. The vulnerability occurs when Cilium is deployed with a custom clusterName (rather than the default "any" value). In this configuration, the parseNetworkPolicyPeer function incorrectly instantiates a pod selector for policies that only specify ipBlock rules without pod or namespace selectors. This causes Cilium to append an unintended wildcard namespace label selector to the Layer 3 allow rules, effectively allowing traffic from any pod in the same namespace as the policy target. The attack requires adjacent network access and low privileges, affecting only v1.19.0 through v1.19.4. The fix (v1.19.5) returns early when both PodSelector and NamespaceSelector are nil, preventing the erroneous selector instantiation. Versions below v1.19.0 are not affected.
Affected products
- Cilium Cilium 1.19.0 through 1.19.4
Timeline
- 2026-07-06: disclosed: Advisory published by Cilium security team
- 2026-06-10: patched: Fix merged to v1.19 branch; v1.19.5 released
- 2026-09-03: advisory: GitHub Advisory Database published
References
- https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r
- https://github.com/cilium/cilium/pull/46305
- https://github.com/cilium/cilium/pull/46456
- https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8
- https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171