Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49445US | high8.8OT elevated | — | ||
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instan… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/cilium/cilium/commit/7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6FIX
- https://github.com/cilium/cilium/pull/44512FIX
- https://github.com/cilium/cilium/releases/tag/v1.17.14ARTICLE
- https://github.com/cilium/cilium/releases/tag/v1.18.8ARTICLE
- https://github.com/cilium/cilium/releases/tag/v1.19.2ARTICLE
- https://github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-49445WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan