Log in Start free

Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-53935CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

Medium 6.9

In plain English

A medium-severity incorrect authorization in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.9Medium
Exploit odds (30 days)0.3%top 72.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cilium/cilium1.19.4GHSA-q6h5-q3q6-f87x
Gogithub.com/cilium/cilium1.18.10GHSA-q6h5-q3q6-f87x
Gogithub.com/cilium/cilium1.17.16GHSA-q6h5-q3q6-f87x
Gogithub.com/cilium/cilium1.17.16, 1.18.10, 1.19.4GO-2026-5914

Affected products (as reported)

VendorProductVersions
cilium cilium < 1.17.16>= 1.18.2, < 1.18.10>= 1.19.0, < 1.19.4

Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

References