---
id: "CVE-2026-56742"
kind: "vulnerability"
aliases: ["CVE-2026-56742", "GHSA-w7c2-w76w-5hmj", "GO-2026-6596"]
title: "Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium"
severity: "high"
cvss: 8.9
epss: 0.00172
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/cilium/cilium", "fixed": ["1.17.17", "1.18.11", "1.19.5"], "affected": ">= 1.19.0, < 1.19.5", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cilium", "gateway-api", "kubernetes", "package"]
not_affected_if: ["default-config", "gateway-api-disabled", "no-untrusted-httproute-authors"]
published_at: "2026-07-15T20:17:51+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:54+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6596", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-56742", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56742", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

Cilium's Gateway API implementation lets a user who can create or update namespaced HTTPRoutes mirror HTTP traffic to any Service in any namespace. This bypasses the ReferenceGrant check that is supposed to block cross-namespace references.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/cilium/cilium affected >= 1.19.0, < 1.19.5 fixed 1.17.17, 1.18.11, 1.19.5

## How to check

Check whether Gateway API is enabled in the Cilium deployment (it is disabled by default).
Check the running Cilium version with: cilium version
List who can create or update HTTPRoutes: kubectl auth can-i create httproutes -n <namespace> --as <user>

## Fix

Upgrade Cilium to 1.17.17, 1.18.11, or 1.19.5 (the affected range is >= 1.19.0, < 1.19.5 per the advisory product data).
Until patched, restrict create and update rights on HTTPRoute resources to trusted users, or disable Gateway API.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6596
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-56742
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56742

## From the sources

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_