CVE-2026-56742: Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism.
Gateway API functionality is disabled by default.
References
- github.com/advisories/GHSA-w7c2-w76w-5hmj
- github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb
- github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857
- github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b
- github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca
- github.com/cilium/cilium/releases/tag/v1.17.17
- github.com/cilium/cilium/releases/tag/v1.18.11
- github.com/cilium/cilium/releases/tag/v1.19.5
- github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj
- nvd.nist.gov/vuln/detail/CVE-2026-56742
Code Behaviors & Features
Detect and mitigate CVE-2026-56742 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →