CVE-2026-33726: Cilium L7 Proxy Bypass of Kubernetes NetworkPolicy for Same-Node Traffic
Summary
CVE-2026-33726: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic. Affects github.com/cilium/cilium across 3 version ranges.
< 1.17.14
>= 1.18.0, < 1.18.8
>= 1.19.0, < 1.19.2
Fixed in 1.17.14, 1.18.8 or 1.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2026-33726 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source networking and security project that provides transparent networking for containers and microservices. It leverages eBPF technology to enforce network policies and manage traffic between services. Cilium's L7 proxy enables advanced traffic management, including Layer 7 (application layer) policies. However, a vulnerability has been identified that allows traffic from pods to L7 services with a local backend on the same node to bypass Kubernetes NetworkPolicy under specific configurations.
Vulnerability Detail
The vulnerability arises when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. In this scenario, ingress Network Policies are not enforced for traffic from pods to L7 Services with a local backend on the same node. This can lead to unauthorized access and potential data leakage, as network policies meant to restrict traffic are ignored. The issue primarily affects deployments using cloud IPAM, such as Cilium ENI on EKS, and can compromise the security posture of affected environments.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.141.17.14go get github.com/cilium/cilium@v1.17.14 -
>= 1.18.0, < 1.18.81.18.8go get github.com/cilium/cilium@v1.18.8 -
>= 1.19.0, < 1.19.21.19.2go get github.com/cilium/cilium@v1.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there is no officially verified workaround for this issue. However, disabling Per-Endpoint Routing may mitigate the risk, though it could disrupt ongoing connections and lead to conflicts in cloud provider environments. To disable Per-Endpoint Routing, you may need to adjust your Cilium configuration accordingly.
Conclusion
The Cilium L7 proxy vulnerability (CVE-2026-33726) presents a significant risk by allowing traffic to bypass Kubernetes NetworkPolicy under certain configurations. It is crucial for users of affected Cilium versions to update to the patched releases to ensure their deployments remain secure.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
The vulnerability allows traffic to bypass Kubernetes NetworkPolicy, potentially leading to unauthorized access and data leakage.
Cilium v1.19 between v1.19.0 and v1.19.1, v1.18 between v1.18.0 and v1.18.7, and all versions prior to v1.17.13 are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
For more information, you can report vulnerabilities to the Cilium security mailing list at security@cilium.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
