Vulnerability record · CVE-2026-56742 · published 15 July 2026

CVE-2026-56742: Cilium missing authorization vulnerability

Cilium · Cilium

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

8.9 CVSS 3.1 High EPSS 0.17% · top 94.1% CWE-862 · Missing authorization

8.9CVSS 3.1 base score

0.17%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Cilium Cilium

References

Link	Tags
https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb	Patch
https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857	Patch
https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b	Patch
https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca	Patch
https://github.com/cilium/cilium/releases/tag/v1.17.17	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.18.11	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.19.5	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj	Vendor Advisory

Track CVE-2026-56742 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-27595Cilium vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a shor…EPSS 0.73%17 Mar 2023 9.0CVE-2023-39347Cilium insufficient verification of data authenticity vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can caus…EPSS 0.50%27 Sep 2023 8.8CVE-2026-49445Cilium incorrect permission assignment vulnerabilityCilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embe…EPSS 0.17%15 Jul 2026 8.7CVE-2024-47825Cilium incorrect default permissions vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 a…EPSS 0.40%21 Oct 2024 8.2CVE-2022-29178Cilium incorrect default permissions vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versi…EPSS 0.28%20 May 2022 8.2CVE-2022-29179Cilium improper privilege management vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9…EPSS 0.36%20 May 2022 8.1CVE-2023-41333Cilium missing authentication for critical function vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNet…EPSS 0.41%27 Sep 2023 7.3CVE-2023-27594Cilium improper authorization vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under speci…EPSS 0.55%17 Mar 2023

Source: NIST National Vulnerability Database (record CVE-2026-56742), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.