CVE-2026-56743
Fixed in a distro release EPSS <1%CVSS 5.4
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.19.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.19-operator-generic | 1.19.7-r7 |
| Chainguard | kubescape | 4.0.12-r13 |
| Chainguard | kubescape-server | 4.0.12-r12 |
| Chainguard | kubescape-server-downloader | 4.0.12-r12 |
| Chainguard | kubescape-server-fips | 4.0.12-r11 |
| Chainguard | kubescape-server-fips-downloader | 4.0.12-r11 |
| SUSE:Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| Wolfi | cilium-1.19-operator-generic | 1.19.7-r7 |
| Wolfi | kubescape | 4.0.12-r13 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |