CVE-2026-56743: Cilium Allows Unexpected Ingress Traffic from Local Namespace Due to Misconfigured NetworkPolicy
Summary
CVE-2026-56743: Cilium is a networking, observability, and security solution. Affects cilium versions >= 1.19.0, < 1.19.5. Fixed in 1.19.5. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- github.com/cilium/cilium · Go
- hubble-relay · Bitnami
- cilium-operator · Bitnami
The same CVE-2026-56743 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source networking, observability, and security solution designed for cloud-native environments, particularly those using Kubernetes. It leverages eBPF technology to provide high-performance networking and security features. Cilium enables users to define fine-grained network policies, monitor traffic, and enforce security controls across microservices. However, a vulnerability was discovered in versions 1.19.0 to 1.19.4 that affects how NetworkPolicies are interpreted, potentially allowing unauthorized ingress traffic.
Vulnerability Detail
The vulnerability arises from a flaw in Cilium's handling of Kubernetes NetworkPolicy specifications that utilize CIDR-based ipBlock rules without pod or namespace selectors. When configured with a custom clusterName, the parser erroneously generates a wildcard namespace allow rule, which permits ingress traffic from other workloads within the same namespace as the policy subject. This misconfiguration can lead to unauthorized access and data exposure, compromising the security of the application.
How To Fix
Minimum fixed version
1.19.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using ipBlock rules without pod or namespace selectors in your NetworkPolicies until you can upgrade to the fixed version. Ensure that your policies are defined with appropriate selectors to prevent unintended traffic.
Conclusion
CVE-2026-56743 is a significant vulnerability in Cilium that allows unauthorized ingress traffic due to misconfigured NetworkPolicies. Users are advised to upgrade to version 1.19.5 or later to mitigate this issue. Until an upgrade can be performed, it is recommended to avoid using certain NetworkPolicy configurations.
See every vulnerability recorded for cilium →
FAQ
The impact includes the potential for unauthorized ingress traffic from other workloads in the same namespace, which can lead to data exposure and security breaches.
Cilium versions 1.19.0 to 1.19.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, avoid using ipBlock rules without selectors in your NetworkPolicies as a temporary workaround.
More information about Cilium can be found on its official GitHub repository and documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium.
