Description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
Published: 2026-02-19
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Faulty Firewall Enforcement
Action: Apply Patch
AI Analysis

Impact

This vulnerability causes Cilium to fail to enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled. Pods on different nodes can communicate through the dataplane, bypassing rules that are normally applied on the host, which could expose services or data to unauthorized pods. The weakness is a bypass of authorization checks, identified as CWE‑266 and CWE‑863.

Affected Systems

Cilium, versions 1.18.0 through 1.18.5, provide a networking and security solution that utilizes an eBPF dataplane. These releases are vulnerable when the native routing, WireGuard and node encryption features are enabled.

Risk and Exploitability

The vulnerability is scored 6.1 on CVSS, indicating moderate severity, with an EPSS score below 1%, showing a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The most likely attack vector is the cluster network; an attacker who can influence pod placement or configuration could exploit the flaw to create cross‑node traffic that should otherwise be blocked.

Generated by OpenCVE AI on April 17, 2026 at 17:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Cilium to version 1.18.6 or later, which contains the fix for this issue.
  • If a rapid upgrade is not possible, temporarily disable Native Routing, WireGuard, and Node Encryption until the updated version is deployed.
  • Restart Cilium agents after applying the new version to ensure the updated dataplane and firewall policies are active.

Generated by OpenCVE AI on April 17, 2026 at 17:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5r23-prx4-mqg3 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled
History

Fri, 20 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*

Fri, 20 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 20 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Cilium
Cilium cilium
Vendors & Products Cilium
Cilium cilium

Fri, 20 Feb 2026 00:00:00 +0000

Type Values Removed Values Added
Description Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
Title Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Cilium Cilium
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-20T15:36:37.658Z

Reserved: 2026-02-16T22:20:28.612Z

Link: CVE-2026-26963

cve-icon Vulnrichment

Updated: 2026-02-20T15:26:47.372Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-20T00:16:16.167

Modified: 2026-02-20T20:12:51.083

Link: CVE-2026-26963

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-02-19T23:38:36Z

Links: CVE-2026-26963 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T17:45:24Z

Weaknesses