CVE-2026-56743

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

View on CVE.org

Published Jul 15, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

Analysis

Technical impact

Between Cilium releases 1.19.0 through 1.19.4, a policy parsing bug caused selectorless CIDR‑based ipBlock rules to create an unintended pod selector when a custom clusterName was configured. This resulted in the policy engine incorrectly permitting traffic from any pod in the same namespace as the policy subject, effectively lifting the intended isolation of the NetworkPolicy. The flaw does not provide arbitrary code execution or host compromise but expands the potential attack surface inside the cluster, raising a confidentiality and integrity risk for intra‑namespace services.

Affected Systems

Cilium, version 1.19.0 to 1.19.4, configured with a custom clusterName and NetworkPolicies that use selectorless ipBlock specifications. Versions 1.19.5 and later contain the fix; other Cilium releases remain unaffected.

Risk and Exploitability

An attacker must be able to create or modify a NetworkPolicy object that includes a selectorless ipBlock while the cluster is running a non‑default clusterName. Once the policy is applied, the bug causes the engine to allow traffic from any pod in that namespace, exposing intra‑namespace services to unintended workloads. The EPSS score is below 1 %, indicating a very low probability of exploitation, and the CVE is not listed in CISA KEV. The vulnerability is therefore moderate in severity (CVSS 5.4) and best addressed through patching and configuration review.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cilium

affected

Version	Status	Constraints
`>= 1.19.0, < 1.19.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Cilium

Version	Status	Scheme	Platform
`[1.19.0,1.19.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Cilium to version 1.19.5 or later
If a custom clusterName is unnecessary, revert to the default clusterName value
Re‑validate all NetworkPolicy objects that use selectorless ipBlock entries to ensure the intended behavior
Monitor inter‑namespace traffic after upgrade to detect any unexpected communication

Generated by OpenCVE AI on July 31, 2026 at 03:00 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-fm8w-2m5w-9j7r	Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.248% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8
https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171
https://github.com/cilium/cilium/pull/46305
https://github.com/cilium/cilium/pull/46456
https://github.com/cilium/cilium/releases/tag/v1.19.5
https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r

History

Jul 16, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cilium Cilium cilium
Vendors & Products		Cilium Cilium cilium

Jul 15, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.
Title		Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
Weaknesses		CWE-863
References		https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8 https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171 https://github.com/cilium/cilium/pull/46305 https://github.com/cilium/cilium/pull/46456 https://github.com/cilium/cilium/releases/tag/v1.19.5 https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`