Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33726Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
Medium 5.4
In plain English
A medium-severity improper access control in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI (`alibabacloud.enabled`), Azure IPAM (`azure.enabled`, but not AKS BYOCNI), and some GKE deployments (`gke.enabled`; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment. Versions 1.17.14, 1.18.8, and 1.19.2 contain a patch. There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/cilium/cilium | 1.17.14 | GHSA-hxv8-4j4r-cqgv |
| Go | github.com/cilium/cilium | 1.18.8 | GHSA-hxv8-4j4r-cqgv |
| Go | github.com/cilium/cilium | 1.19.2 | GHSA-hxv8-4j4r-cqgv |
| Go | github.com/cilium/cilium | 1.17.14, 1.18.8, 1.19.2 | GO-2026-4856 |
Affected products (as reported)
Weakness: CWE-284, CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/cilium/cilium/security/advisories/GHSA-hxv8-4j4r-cqgv x_refsource_CONFIRM
- https://github.com/cilium/cilium/pull/44693 x_refsource_MISC
- https://docs.cilium.io/en/stable/network/concepts/routing/#routing x_refsource_MISC
- https://docs.cilium.io/en/stable/network/kubernetes/policy/#network-policy x_refsource_MISC
- https://docs.cilium.io/en/stable/network/servicemesh/l7-traffic-management x_refsource_MISC
- https://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routing x_refsource_MISC