{"schema":"threatline.record/2","record":{"id":"CVE-2026-56742","aliases":["BIT-cilium-2026-56742","BIT-cilium-operator-2026-56742","BIT-hubble-relay-2026-56742","GHSA-w7c2-w76w-5hmj","GO-2026-6596"],"summary":"Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces","details":"### Impact\n\nIn Cilium clusters using [Gateway API](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/), users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism.\n\nGateway API functionality is disabled by default.\n\n### Patches\n\nThis issue affects:\n\n* Cilium v1.19 from v1.19.0 to v1.19.4 inclusive\n* Cilium v1.18 from v1.18.0 to v1.18.10 inclusive\n* All versions of Cilium before v1.17.17\n\nThis issue is patched in:\n\n* Cilium v1.19.5\n* Cilium v1.18.11\n* Cilium v1.17.17\n\n### Workarounds\n\nThere is no workaround to this issue. Users of this feature who are unable to upgrade can mitigate the risk by ensuring that RBAC permissions to create `HTTPRoute` objects are only granted to cluster admins.\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @galanko for reporting the issue and @mhofstetter for their work on triaging and remediating this issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/).\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.","categories":["Libraries & packages"],"product":"github.com/cilium/cilium","vendor":"cilium","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/cilium"},"range":"< 1.17.17"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/ciliumCilium"},"range":">= 1.18.0, < 1.18.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/cilium"},"range":">= 1.19.0, < 1.19.5"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-56742","source_modified_at":"2026-07-16T12:57:08.040Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"cilium","vendor":"cilium","versions":[{"version":"< 1.17.17","status":"affected"},{"version":">= 1.18.0, < 1.18.11","status":"affected"},{"version":">= 1.19.0, < 1.19.5","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.17.17"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/ciliumCilium","purl":"pkg:golang/github.com/cilium/ciliumCilium"},"ranges":[{"events":[{"introduced":"1.18.0"},{"fixed":"1.18.11"}],"type":"SEMVER"}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium"},"ranges":[{"events":[{"introduced":"1.19.0"},{"fixed":"1.19.5"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/cilium"},"version":"1.17.17"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/ciliumCilium"},"version":"1.18.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-09-24T19:38:41Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/cilium/cilium"},"version":"1.19.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium"},"version":"1.17.17"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/ciliumCilium","purl":"pkg:golang/github.com/cilium/ciliumCilium"},"version":"1.18.11"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","source_modified_at":"2026-10-01T20:56:11.816067258Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium"},"version":"1.19.5"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00172,"percentile":0.06283,"score_date":"2026-10-23"},"published_at":"2026-07-15T19:14:07.617Z","modified_at":"2026-10-01T20:56:11.816067258Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T19:38:41Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-56742","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-16T12:57:08.040Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-w7c2-w76w-5hmj","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T20:56:11.816067258Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56742","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56742","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/releases/tag/v1.17.17","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/releases/tag/v1.18.11","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cilium/cilium/releases/tag/v1.19.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-w7c2-w76w-5hmj","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-07-16T12:56:22.128191Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T20:56:11.816067258Z","content_hash":"558dc792d8350ebc9942686794f35844ccb5cf0550ec7ce992561ab381b20d59"}}