Cilium, a networking and security platform, has a flaw (CWE‑862: Privilege Escalation – Missing Authorization) where users with permission to create or update namespaced HTTPRoutes can configure those routes to point to any Service in any namespace. The vulnerability bypasses the ReferenceGrant authorization mechanism that is meant to restrict cross‑namespace traffic. As a result, an attacker could redirect legitimate HTTP traffic to a malicious service in another namespace, potentially exposing sensitive data or facilitating lateral movement.

The issue affects Cilium clusters running versions prior to 1.17.17, 1.18.11, or 1.19.5 that have the Gateway API enabled. Gateway API functionality is disabled by default, but if it has been enabled, the affected releases are vulnerable.

The CVSS score is 5.9, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation, and it is not listed in CISA’s KEV catalog. However, the flaw can be exploited by an authenticated user with permissions to create or edit HTTPRoutes; thus organizations using gateway functionality or with permissive RBAC should consider the risk significant enough to apply the fix promptly.