CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
Local attackers can access Envoy admin sockets to expose TLS secrets and disrupt cluster traffic when L7 functionality is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49445?
CVE-2026-49445 is a critical vulnerability in cilium, published on 15 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
Weakness: CWE-732
Which versions are affected by CVE-2026-49445?
10 open source packages ship an affected version, including github.com/cilium/cilium, cilium and cilium-operator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cilium/cilium Go | All versions | 1.17.14, 1.18.8, 1.19.2 |
github.com/cilium/cilium Go | All versions | 1.17.14 |
github.com/cilium/cilium Go | All versions | 1.17.14 |
github.com/cilium/cilium Go | From 1.18.0 | 1.18.8 |
github.com/cilium/cilium Go | From 1.18.0 | 1.18.8 |
github.com/cilium/cilium Go | From 1.19.0 | 1.19.2 |
4 more packages
github.com/cilium/cilium Go | From 1.19.0 | 1.19.2 |
cilium Bitnami | All versions | 1.17.14, 1.18.8, 1.19.2 |
cilium-operator Bitnami | All versions | 1.17.14, 1.18.8, 1.19.2 |
hubble-relay Bitnami | All versions | 1.17.14, 1.18.8, 1.19.2 |
Linux distribution packages (1)
kubeshark-cli openSUSE:Tumbleweed | All versions | 53.4.0-1.1 |
Products include Cilium Cilium.
How do I fix CVE-2026-49445?
Upgrade github.com/cilium/cilium to a fixed version for your release line: 1.17.14, 1.18.8 or 1.19.2.
Is CVE-2026-49445 being exploited?
There is no known exploitation of CVE-2026-49445 in the wild and no public exploit code.
Other vulnerabilities in cilium
- CVE-2022-29178 Incorrect Default Permissions in Cilium
- CVE-2024-28860 Insecure IPsec transport encryption in Cilium
- CVE-2026-41520 Cillium exposes sensitive information included in the cilium-bugtool debug archive
- CVE-2024-37307 Cilium leaks sensitive information in cilium-bugtool
- CVE-2023-39347 Cilium NetworkPolicy bypass via pod labels
Sources
Also known as BIT-cilium-2026-49445, BIT-cilium-operator-2026-49445, BIT-hubble-relay-2026-49445, GHSA-3fcv-jvfp-m4q9, GO-2026-5905, MINI-2c39-rvv8-c2mq and 18 more.