CRITICAL9.2CVE-2026-49445Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium >= 1.19.0, < 1.19.2
CRITICAL9.2CVE-2026-49445Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium from 0, < 1.17.14, >= 1.18.0, < 1.18.8, >= 1.19.0, < 1.19.2
HIGH8.8Incorrect Default Permissions in Cilium
>= 1.11.0, < 1.11.5
HIGH8.8Incorrect Default Permissions in Cilium
from 0, < 1.9.16, >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.5
HIGH8.0Insecure IPsec transparent encryption in github.com/cilium/cilium
>= 1.4.0, < 1.13.14
HIGH8.0Insecure IPsec transparent encryption in github.com/cilium/cilium
from 0, < 1.13.14, >= 1.14.0, < 1.14.9, >= 1.15.0, < 1.15.3
HIGH7.9Cillium exposes sensitive information included in the cilium-bugtool debug archive
from 0, < 1.17.15
HIGH7.9Cillium exposes sensitive information included in the cilium-bugtool debug archive
from 0, < 1.17.15, >= 1.18.0, < 1.18.9, >= 1.19.0, < 1.19.3
HIGH7.9Cilium leaks sensitive information in cilium-bugtool
>= 1.13.0, < 1.13.17
HIGH7.9Cilium leaks sensitive information in cilium-bugtool
>= 1.13.0, < 1.13.17, >= 1.14.0, < 1.14.12, >= 1.15.0, < 1.15.6
HIGH7.5Improper Privilege Management in Cilium
>= 1.11.0, < 1.11.5
HIGH7.5Improper Privilege Management in Cilium
from 0, < 1.9.16, >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.5
HIGH7.2HTTP policy bypass in github.com/cilium/cilium
>= 1.13.9, < 1.13.13
HIGH7.2HTTP policy bypass in github.com/cilium/cilium
>= 1.13.9, < 1.13.13, >= 1.14.0, < 1.14.8, >= 1.15.0, < 1.15.2
HIGH7.2Debug mode leaks confidential data in Cilium
>= 1.7.0, <= 1.10.0
HIGH7.2Debug mode leaks confidential data in Cilium
>= 1.7.0, < 1.11.16, >= 1.12.0, < 1.12.9, >= 1.13.0, < 1.13.2
MEDIUM6.9CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
>= 1.19.0, < 1.19.4
MEDIUM6.9CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
from 0, < 1.17.16, >= 1.18.2, < 1.18.10, >= 1.19.0, < 1.19.4
MEDIUM6.9Bypass of namespace restrictions in CiliumNetworkPolicy
>= 1.14.0, < 1.14.2
MEDIUM6.9Bypass of namespace restrictions in CiliumNetworkPolicy
from 0, < 1.12.14, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.2
MEDIUM6.8Cilium agent's race condition may lead to policy bypass for Host Firewall policy
from 0, < 1.14.14
MEDIUM6.8Cilium agent's race condition may lead to policy bypass for Host Firewall policy
from 0, < 1.14.14, >= 1.15.0, < 1.15.8
MEDIUM6.5Cilium vulnerable to information leakage via insecure default Hubble UI CORS header
>= 1.14.0, < 1.14.19
MEDIUM6.5Cilium vulnerable to information leakage via insecure default Hubble UI CORS header
>= 1.14.0, < 1.14.19, >= 1.15.0, < 1.15.13, >= 1.16.0, < 1.16.6
MEDIUM6.5Cilium eBPF filters may be temporarily removed during agent restart
>= 1.13.0, < 1.13.1
MEDIUM6.5Cilium eBPF filters may be temporarily removed during agent restart
>= 1.13.0, < 1.13.1
MEDIUM6.1Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled
>= 1.18.0, < 1.18.6
MEDIUM6.1Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled
>= 1.18.0, < 1.18.6
MEDIUM6.1Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium
>= 1.14.0, < 1.14.8
MEDIUM6.1Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium
>= 1.14.0, < 1.14.8, >= 1.15.0, < 1.15.2
MEDIUM6.1Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
from 0, < 1.13.13
MEDIUM6.1Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
from 0, < 1.13.13, >= 1.14.0, < 1.14.8, >= 1.15.0, < 1.15.2
MEDIUM6.1Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
>= 1.14.0, < 1.14.7
MEDIUM6.1Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
>= 1.14.0, < 1.14.7
MEDIUM6.1Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
>= 1.14.0, < 1.14.7
MEDIUM6.1Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
>= 1.14.0, < 1.14.7
MEDIUM5.8Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium
>= 1.16.0, < 1.16.4
MEDIUM5.8Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium
>= 1.16.0, < 1.16.4
MEDIUM5.4Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
from 0, < 1.17.14
MEDIUM5.4Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
from 0, < 1.17.14, >= 1.18.0, < 1.18.8, >= 1.19.0, < 1.19.2
MEDIUM5.4Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API
>= 1.16.0, < 1.16.1
MEDIUM5.4Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API
>= 1.15.0, < 1.15.8, >= 1.16.0, < 1.16.1
MEDIUM5.4Cilium NetworkPolicy bypass via pod labels
>= 1.13.0, < 1.13.7
MEDIUM5.4Cilium NetworkPolicy bypass via pod labels
from 0, < 1.12.14, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.2
MEDIUM5.3DoS in Cilium agent DNS proxy from crafted DNS responses
>= 1.14.0, < 1.14.18
MEDIUM5.3DoS in Cilium agent DNS proxy from crafted DNS responses
>= 1.14.0, < 1.14.18, >= 1.15.0, < 1.15.12, >= 1.16.0, < 1.16.5
MEDIUM5.3Potential HTTP policy bypass when using header rules in Cilium
from 0, < 1.11.16
MEDIUM5.3Potential HTTP policy bypass when using header rules in Cilium
from 0, < 1.11.16, >= 1.12.0, < 1.12.9, >= 1.13.0, < 1.13.2
MEDIUM4.4cilium-agent container can access the host via `hostPath` mount
from 0, < 1.11.15
MEDIUM4.2Cilium vulnerable to potential network policy bypass when routing IPv6 traffic
from 0, < 1.11.15
MEDIUM4.2Cilium vulnerable to potential network policy bypass when routing IPv6 traffic
from 0, < 1.11.15, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.1
MEDIUM4.0Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
>= 1.18.0, < 1.18.4
MEDIUM4.0Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
>= 1.13.0, < 1.15.16
MEDIUM4.0Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
>= 1.13.0, < 1.15.16, >= 1.16.0, < 1.16.9, >= 1.17.0, < 1.17.3
MEDIUM4.0CIDR deny policies may not take effect when a more narrow CIDR allow is present
>= 1.15.0, < 1.15.10
MEDIUM4.0CIDR deny policies may not take effect when a more narrow CIDR allow is present
>= 1.14.0, < 1.14.16, >= 1.15.0, < 1.15.10
MEDIUM4.0Cilium's Gateway API route matching order contradicts specification
>= 1.16.0, < 1.16.1
MEDIUM4.0Cilium's Gateway API route matching order contradicts specification
>= 1.15.0, < 1.15.8, >= 1.16.0, < 1.16.1
LOW3.5Denial of service via Kubernetes annotations in specific Cilium configurations
>= 1.14.0, < 1.14.2
LOW3.5Denial of service via Kubernetes annotations in specific Cilium configurations
from 0, < 1.12.14, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.2
LOW3.4Node based network policies may incorrectly allow workload traffic
>= 1.16.0, < 1.16.8
LOW3.4Cilium vulnerable to information leakage via incorrect ReferenceGrant handling
>= 1.13.0, < 1.13.4
LOW3.4Cilium vulnerable to information leakage via incorrect ReferenceGrant handling
>= 1.13.0, < 1.13.4
LOW3.2East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
>= 1.16.0, < 1.16.8
LOW3.2East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
>= 1.15.0, < 1.15.15, >= 1.16.0, < 1.16.8, >= 1.17.0, < 1.17.2