Live › vulnerability › CVE-2026-56742
Go to dashboardCilium's Gateway API implementation lets a user who can create or update namespaced HTTPRoutes mirror HTTP traffic to any Service in any namespace. This bypasses the ReferenceGrant check that is supposed to block cross-namespace references.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/cilium/cilium | go | >= 1.19.0, < 1.19.5 | 1.17.17, 1.18.11, 1.19.5 |
1.17.17, 1.18.11, or 1.19.5 (the affected range is >= 1.19.0, < 1.19.5 per the advisory product data)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-56742")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.