Critical severity9.2NVD Advisory· Published Jul 15, 2026· Updated Jul 17, 2026
CVE-2026-49445
CVE-2026-49445
Description
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cilium/ciliumGo | >= 1.19.0, < 1.19.2 | 1.19.2 |
github.com/cilium/ciliumGo | >= 1.18.0, < 1.18.8 | 1.18.8 |
github.com/cilium/ciliumGo | < 1.17.14 | 1.17.14 |
Affected products
7- osv-coords5 versionspkg:bitnami/ciliumpkg:bitnami/cilium-operatorpkg:bitnami/hubble-relaypkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kubeshark-cli&distro=openSUSE%20Tumbleweed
< 1.17.14+ 4 more
- (no CPE)range: < 1.17.14
- (no CPE)range: < 1.17.14
- (no CPE)range: < 1.17.14
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 53.4.0-1.1
Patches
Vulnerability mechanics
References
7- github.com/cilium/cilium/commit/7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6nvdPatch
- github.com/cilium/cilium/pull/44512nvdPatchWEB
- github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-3fcv-jvfp-m4q9ghsaADVISORY
- github.com/cilium/cilium/releases/tag/v1.17.14nvdRelease Notes
- github.com/cilium/cilium/releases/tag/v1.18.8nvdRelease Notes
- github.com/cilium/cilium/releases/tag/v1.19.2nvdRelease Notes
News mentions
0No linked articles in our index yet.