PT-2026-60282 · Cilium · Cilium

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-56743

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-56743

Produtos afetados

Cilium

Referências · 7

• https://github.com/cilium/cilium/pull/46305 · Nota
• https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171 · Nota
• https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8 · Nota
• https://github.com/cilium/cilium/pull/46456 · Nota
• https://github.com/cilium/cilium/releases/tag/v1.19.5 · Nota
• https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56743 · Nota de Segurança