https://seclists.org/oss-sec/2026/q3/85: [CVE quest] Cilium ClusterNetworkPolicy matchExpssions Values silently dropped — 0-day in v1.20.0-pleases, no maintainer sponse in 9 days via GHSA Triage

Q: Are released Cilium versions affected?

No released stable versions are affected according to the Cilium Security Team. The issue affects only development snapshots of Cilium.

Q: Should production deployments be considered exposed?

The Cilium Security Team states that it does not expect the affected development snapshots to be used in production environments. Production users of released stable versions are not identified as affected in the provided information.

Q: Is a CVE expected for this issue?

The Cilium Security Team stated that it does not see a benefit to CVE issuance because the issue affects development snapshots only.

Published Jul 7, 2026

Updated

Affected Software

1 affected component

Cilium Cilium>2026-02-13<=2026-05-29, =v1.20.0-pre.1, =v1.20.0-pre.2

Frequently Asked Questions

Are released Cilium versions affected?

No released stable versions are affected according to the Cilium Security Team. The issue affects only development snapshots of Cilium.

Should production deployments be considered exposed?

The Cilium Security Team states that it does not expect the affected development snapshots to be used in production environments. Production users of released stable versions are not identified as affected in the provided information.

Is a CVE expected for this issue?

The Cilium Security Team stated that it does not see a benefit to CVE issuance because the issue affects development snapshots only.