Cilium vulnerabilities
40 CVEs and advisories name Cilium as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-65960Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods
- CVE-2026-56743Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
- CVE-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
- CVE-2026-49445Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
- CVE-2026-53935CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
- CVE-2026-10722cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow
- CVE-2026-41520Cillium exposes sensitive information included in the cilium-bugtool debug archive
- CVE-2026-33726Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
- CVE-2026-26963Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled
- CVE-2025-64715Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
- CVE-2025-48056Hubble CLI vulnerable to character injection
- CVE-2025-32793Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
- CVE-2025-30163Node based network policies may incorrectly allow workload traffic
- CVE-2025-30162East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
- CVE-2025-23047Cilium vulnerable to information leakage via insecure default Hubble UI CORS header
- CVE-2025-23028DoS in Cilium agent DNS proxy from crafted DNS responses
- CVE-2024-52529Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium
- CVE-2024-47825CIDR deny policies may not take effect when a more narrow CIDR allow is present
- CVE-2024-42486Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API
- CVE-2024-42488Cilium agent's race condition may lead to policy bypass for Host Firewall policy
- CVE-2024-42487Cilium's Gateway API route matching order contradicts specification
- CVE-2024-37307Cilium leaks sensitive information in cilium-bugtool
- CVE-2024-28860Insecure IPsec transport encryption in Cilium
- CVE-2024-28250Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies
- CVE-2024-28249Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies
- CVE-2024-28248Cilium intermittent HTTP policy bypass
- CVE-2024-25631Unencrypted traffic between pods when using Wireguard and an external kvstore
- CVE-2024-25630Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption
- CVE-2023-41332Denial of service via Kubernetes annotations in specific Cilium configurations
- CVE-2023-41333Bypass of namespace restrictions in CiliumNetworkPolicy