Vulnerability record · CVE-2026-49445 · published 15 July 2026

CVE-2026-49445: Cilium incorrect permission assignment vulnerability

Cilium · Cilium

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

8.8 CVSS 3.1 High EPSS 0.17% · top 94.8% CWE-732 · Incorrect permission assignment

8.8CVSS 3.1 base score

0.17%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Cilium Cilium

References

Link	Tags
https://github.com/cilium/cilium/commit/7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6	Patch
https://github.com/cilium/cilium/pull/44512	Patch
https://github.com/cilium/cilium/releases/tag/v1.17.14	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.18.8	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.19.2	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9	PatchVendor Advisory

Track CVE-2026-49445 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-27595Cilium vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a shor…EPSS 0.73%17 Mar 2023 9.0CVE-2023-39347Cilium insufficient verification of data authenticity vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can caus…EPSS 0.50%27 Sep 2023 8.9CVE-2026-56742Cilium missing authorization vulnerabilityCilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users wi…EPSS 0.17%15 Jul 2026 8.7CVE-2024-47825Cilium incorrect default permissions vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 a…EPSS 0.40%21 Oct 2024 8.2CVE-2022-29178Cilium incorrect default permissions vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versi…EPSS 0.28%20 May 2022 8.2CVE-2022-29179Cilium improper privilege management vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9…EPSS 0.36%20 May 2022 8.1CVE-2023-41333Cilium missing authentication for critical function vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNet…EPSS 0.41%27 Sep 2023 7.3CVE-2023-27594Cilium improper authorization vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under speci…EPSS 0.55%17 Mar 2023

Source: NIST National Vulnerability Database (record CVE-2026-49445), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.