CVE-2026-56742: Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Impact
In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism.
Gateway API functionality is disabled by default.
Patches
This issue affects:
Cilium v1.19 from v1.19.0 to v1.19.4 inclusive Cilium v1.18 from v1.18.0 to v1.18.10 inclusive All versions of Cilium before v1.17.17
This issue is patched in:
Cilium v1.19.5 Cilium v1.18.11 Cilium v1.17.17
Workarounds
There is no workaround to this issue. Users of this feature who are unable to upgrade can mitigate the risk by ensuring that RBAC permissions to create HTTPRoute objects are only granted to cluster admins.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @galanko for reporting the issue and @mhofstetter for their work on triaging and remediating this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Other sources
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.19.5 - Upgrade
Upgrade
go/github.com/cilium/ciliumCiliumto a version that resolves this vulnerability.Fixed in 1.18.11 - Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.17.17 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in 1.17.17 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in 1.18.11 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in 1.19.5 - Compensating control
For users unable to upgrade, grant permissions to create HTTPRoute objects only to cluster admins.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56742?
The severity of CVE-2026-56742 is rated as medium with a score of 5.9.
What is the risk associated with CVE-2026-56742?
CVE-2026-56742 has a risk score of 41, indicating a moderate level of risk.
How do I fix CVE-2026-56742?
To fix CVE-2026-56742, upgrade Cilium to versions 1.17.17, 1.18.11, or 1.19.5 or later.
What type of attack does CVE-2026-56742 relate to?
CVE-2026-56742 relates to unauthorized HTTP traffic redirection between namespaces within Cilium clusters.
Who is affected by CVE-2026-56742?
CVE-2026-56742 affects users of Cilium that have permissions to create or update namespaced HTTPRoutes.