Critical severityNVD Advisory· Published Jul 15, 2026· Updated Jul 16, 2026
Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
CVE-2026-49445
Description
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cilium/ciliumGo | >= 1.19.0, < 1.19.2 | 1.19.2 |
github.com/cilium/ciliumGo | >= 1.18.0, < 1.18.8 | 1.18.8 |
github.com/cilium/ciliumGo | < 1.17.14 | 1.17.14 |
Affected products
4- osv-coords3 versions
< 1.17.14+ 2 more
- (no CPE)range: < 1.17.14
- (no CPE)range: < 1.17.14
- (no CPE)range: < 1.17.14
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-3fcv-jvfp-m4q9ghsaADVISORY
- github.com/cilium/cilium/commit/7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6mitrex_refsource_MISC
- github.com/cilium/cilium/pull/44512ghsax_refsource_MISCWEB
- github.com/cilium/cilium/releases/tag/v1.17.14mitrex_refsource_MISC
- github.com/cilium/cilium/releases/tag/v1.18.8mitrex_refsource_MISC
- github.com/cilium/cilium/releases/tag/v1.19.2mitrex_refsource_MISC
- github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.