CVE-2026-56742

highpriority · track · 36OT risk · elevatedEPSS 0.002 · 7 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.18% (7th) EPSS
CVSS 8.9 · high
Is it mine?
19 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

01

cvss

Technical severity, 0–10. One row per scoring source.

8.9
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.9

v3.18.9highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Lprimary · NVD / NIST USexploitability 2.3 · impact 6
v3.15.9mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · ENISA EU
v3.15.9mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · security-advisories@github.comexploitability 1.7 · impact 3.7
v3.15.9mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · OSV
v3.18.1highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-862USCWE-862US
04

affected products (19)

Products and version ranges known to be affected.

05

advisories (5)

Vendor and ecosystem advisories describing this.

  • GHSA-w7c2-w76w-5hmjCilium: Namespaced HTTPRoutes can redirect traffic to other namespaces2026-09-24ghsa · osvUS

    ### Impact In Cilium clusters using [Gateway API](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/), users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. ### Patches This issue affects: * Cilium v1.19 from v1.19.0 to v1.19.4 inclusive * Cilium v1.18 from v1.18.0 to v1.18.10 inclusive * All versions of Cilium before v1.17.17 This issue is patched in: * Cilium v1.19.5 * Cilium v1.18.11 * Cilium v1.17.17 ### Workarounds There is no workaround to this issue. Users of this feature who are unable to upgrade can mitigate the risk by ensuring that RBAC permissions to create `HTTPRoute` objects are only granted to cluster admins. ### Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @galanko for reporting the issue and @mhofstetter for their work on triaging and remediating this issue. ### For more information If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/). If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

  • BIT-cilium-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces2026-07-19vendor · osvUS

    Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

  • BIT-cilium-operator-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces2026-07-19vendor · osvUS

    Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

  • BIT-hubble-relay-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces2026-07-19vendor · osvUS

    Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

  • GO-2026-6596Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium2026-10-01vendor · osvUS

    Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

06

also known as (7)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdNVDCVE.orgMITRE
published 2026-07-15modified 2026-07-17
08

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan