CVE-2026-49445
Fixed in a distro release EPSS <1%CVSS 9.2
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.19.2 |
| Go | github.com/cilium/cilium | 1.18.8 |
| Go | github.com/cilium/cilium | 1.17.14 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.16 | no fix |
| Chainguard | cilium-1.16-clustermesh-apiserver | no fix |
| Chainguard | cilium-1.16-hubble-relay | no fix |
| Chainguard | cilium-1.16-operator-aws | no fix |
| Chainguard | cilium-1.16-operator-generic | no fix |
| Chainguard | cilium-fips-1.16 | no fix |
| Chainguard | cilium-fips-1.16-clustermesh-apiserver | no fix |
| Chainguard | cilium-fips-1.16-host-utils | no fix |
| Chainguard | cilium-fips-1.16-hubble-relay | no fix |
| Chainguard | cilium-fips-1.16-operator-aws | no fix |
| Chainguard | cilium-fips-1.16-operator-azure | no fix |
| Chainguard | cilium-fips-1.16-operator-generic | no fix |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | kubeshark-cli | 53.4.0-1.1 |