{"id":"CVE-2026-56742","kind":"vulnerability","aliases":["CVE-2026-56742","GHSA-w7c2-w76w-5hmj","GO-2026-6596"],"related":[],"title":"Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium","description":"Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.","summary":"Cilium's Gateway API implementation lets a user who can create or update namespaced HTTPRoutes mirror HTTP traffic to any Service in any namespace. This bypasses the ReferenceGrant check that is supposed to block cross-namespace references.","severity":"high","cvss":8.9,"epss":0.00172,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cilium/cilium","fixed":["1.17.17","1.18.11","1.19.5"],"affected":">= 1.19.0, < 1.19.5","ecosystem":"go"}],"ecosystems":["go"],"tags":["cilium","gateway-api","kubernetes","package"],"not_affected_if":["default-config","gateway-api-disabled","no-untrusted-httproute-authors"],"how_to_check":"Check whether Gateway API is enabled in the Cilium deployment (it is disabled by default).\nCheck the running Cilium version with: cilium version\nList who can create or update HTTPRoutes: kubectl auth can-i create httproutes -n <namespace> --as <user>","fix":"Upgrade Cilium to 1.17.17, 1.18.11, or 1.19.5 (the affected range is >= 1.19.0, < 1.19.5 per the advisory product data).\nUntil patched, restrict create and update rights on HTTPRoute resources to trusted users, or disable Gateway API.","status":"open","published_at":"2026-07-15T20:17:51+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:54+00:00","updated_at":"2026-10-23T21:43:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:43:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Cilium to 1.17.17, 1.18.11, or 1.19.5 (the affected range is >= 1.19.0, < 1.19.5 per the advisory product data).\nUntil patched, restrict create and update rights on HTTPRoute resources to trusted users, or disable Gateway API.","reach":"network","impact":"medium","summary":"Cilium's Gateway API implementation lets a user who can create or update namespaced HTTPRoutes mirror HTTP traffic to any Service in any namespace. This bypasses the ReferenceGrant check that is supposed to block cross-namespace references.","category":"package","who_cares":["cilium","kubernetes","gateway-api"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authorized tenant mirrors cluster traffic from other namespaces to attacker-controlled destinations.","analyst_note":"","how_to_check":"Check whether Gateway API is enabled in the Cilium deployment (it is disabled by default).\nCheck the running Cilium version with: cilium version\nList who can create or update HTTPRoutes: kubectl auth can-i create httproutes -n <namespace> --as <user>","needs_analyst":false,"not_affected_if":["gateway-api-disabled","default-config","no-untrusted-httproute-authors"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000548,"input_tokens":3014,"output_tokens":494,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-56742':16A,27A '-6596':24A '/cilium/cilium':13A,30A '1.17.17':85C,132C '1.18.11':86C,133C '1.19.5':88C,135C '5hmj':21A 'allow':94C 'api':34B,40B,93C,120C 'author':117C 'block':70B 'bypass':62B,114C 'check':65B 'cilium':1A,31B,37B,75C,89C 'cluster':90C 'creat':47B,99C 'cross':72B 'cross-namespac':71B 'cve':14A,25A 'default':125C 'disabl':123C 'fix':129C 'function':121C 'gateway':33B,39B,92C,119C 'gateway-api':32B 'ghsa':18A 'ghsa-w7c2-w76w-5hmj':17A 'github.com':12A,29A 'github.com/cilium/cilium':11A,28A 'go':22A 'http':53B,106C 'httprout':3A,51B,103C 'implement':41B 'issu':127C 'kubernet':35B 'let':42B 'mechan':118C 'mirror':52B,105C 'namespac':2A,9A,50B,60B,73B,102C,113C 'network':78C 'observ':79C 'packag':36B 'permiss':97C 'prior':83C 'redirect':5A 'refer':74B 'referencegr':64B,116C 'secur':81C 'servic':57B,110C 'solut':82C 'suppos':68B 'traffic':6A,54B,107C 'updat':49B,101C 'use':91C 'user':44B,95C 'version':131C 'w76w':20A 'w7c2':19A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-15T20:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6596","url":"https://pkg.go.dev/vuln/GO-2026-6596","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-07T14:10:10+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56742","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56742","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56742","severity":null,"published_at":"2026-07-15T20:17:51+00:00","modified_at":"2026-07-17T17:48:48+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}