PT-2026-35502 · Cilium · Cilium

Kodareef5 · Published 2026-04-25 · Updated 2026-05-18 · CVE-2026-41520

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions prior to 1.17.15 Cilium versions 1.18.0 through 1.18.8 Cilium versions 1.19.0 through 1.19.2

Description When run against deployments with WireGuard encryption enabled, the output of the cilium-bugtool debugging tool can contain sensitive data. Specifically, the WireGuard private key cilium wg0.key, used for node-to-node encrypted communication, may be exposed. This tool is typically invoked manually or during the gathering of sysdumps via the cilium sysdump command.

Recommendations Update to version 1.17.15 for versions prior to 1.17.15. Update to version 1.18.9 for versions 1.18.0 through 1.18.8. Update to version 1.19.3 for versions 1.19.0 through 1.19.2. Rotate WireGuard keys on affected nodes by deleting the key file and restarting the Cilium agent to generate a new key pair if bugtool or sysdump archives have been shared.

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

BIT-CILIUM-2026-41520

BIT-CILIUM-OPERATOR-2026-41520

BIT-HUBBLE-RELAY-2026-41520

CVE-2026-41520

GHSA-GJ49-89WH-H4GJ

Affected Products

Cilium

References · 16

• https://github.com/cilium/cilium/security/advisories/GHSA-gj49-89wh-h4gj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gj49-89wh-h4gj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2026-41520 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2026-41520 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2026-41520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41520 · Security Note
• https://github.com/cilium/cilium/releases/tag/v1.17.15 · Note
• https://github.com/cilium/cilium/releases/tag/v1.19.3 · Note
• https://github.com/cilium/cilium/releases/tag/v1.18.9 · Note
• https://github.com/cilium/cilium · Note
• https://twitter.com/VulmonFeeds/status/2052962914768679001 · Twitter Post
• http://docs.cilium.io/en/stable/security/network/encryption-wireguard · Note
• https://t.me/cveNotify/163866 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1sy0a2l/resumen_diario_de_vulnerabilidades_28042026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1sx7q7j/resumen_diario_de_vulnerabilidades_27042026 · Reddit Post