CVE-2026-56743
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.
| CWE | CWE-863 |
| Vendor | cilium |
| Product | cilium |
| Published | Jul 15, 2026 |
| Last Updated | Jul 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for cilium cilium
Be the first to know when new medium vulnerabilities affecting cilium cilium are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
cilium / cilium
>= 1.19.0, < 1.19.5
References
github.com: https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r github.com: https://github.com/cilium/cilium/pull/46305 github.com: https://github.com/cilium/cilium/pull/46456 github.com: https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8 github.com: https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171 github.com: https://github.com/cilium/cilium/releases/tag/v1.19.5