Log in Start free

Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-49445Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Critical 9.2

In plain English

A critical-severity incorrect permission assignment in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.2Critical
Exploit odds (30 days)0.2%top 94.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cilium/cilium1.17.14, 1.18.8, 1.19.2GO-2026-5905
Gogithub.com/cilium/cilium1.19.2GHSA-3fcv-jvfp-m4q9
Gogithub.com/cilium/cilium1.18.8GHSA-3fcv-jvfp-m4q9
Gogithub.com/cilium/cilium1.17.14GHSA-3fcv-jvfp-m4q9

Affected products (as reported)

VendorProductVersions
cilium cilium < 1.17.14>= 1.18.0, < 1.18.8>= 1.19.0, < 1.19.2

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

References