PT-2026-60281 · Cilium · Cilium

CVE-2026-56742 · Published 2026-07-15 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Cilium versions prior to 1.17.17 Cilium versions prior to 1.18.11 Cilium versions prior to 1.19.5

Description In clusters using the Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace. This action bypasses the ReferenceGrant authorization mechanism, which is intended to control cross-namespace resource references. Gateway API functionality is disabled by default.

Recommendations Update to version 1.17.17. Update to version 1.18.11. Update to version 1.19.5.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-CILIUM-2026-56742

BIT-CILIUM-OPERATOR-2026-56742

BIT-HUBBLE-RELAY-2026-56742

CVE-2026-56742

GHSA-W7C2-W76W-5HMJ

Affected Products

Cilium

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56742.json · Exploit
• https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca · Patch
• https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj · Vendor Advisory
• https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb · Patch
• https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857 · Patch
• https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56742 · Security Note
• https://osv.dev/vulnerability/CVE-2026-56742 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2026-56742 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2026-56742 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2026-56742 · Vendor Advisory
• https://github.com/cilium/cilium/releases/tag/v1.17.17 · Note
• https://github.com/cilium/cilium/releases/tag/v1.18.11 · Note
• https://github.com/cilium/cilium/releases/tag/v1.19.5 · Note