CVE-2026-33726
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
描述
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI (`alibabacloud.enabled`), Azure IPAM (`azure.enabled`, but not AKS BYOCNI), and some GKE deployments (`gke.enabled`; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment. Versions 1.17.14, 1.18.8, and 1.19.2 contain a patch. There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.
如何修補 CVE-2026-33726
要修補 CVE-2026-33726,請將受影響套件升級到下列已修補版本。
- —升級至 1.17.14 或更新版本
- —升級至 1.17.14 或更新版本
- —升級至 1.17.14 或更新版本
- —升級至 1.17.14 或更新版本
- —升級至 1.17.14 或更新版本
CVE-2026-33726 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。