VULNERABILITY INTELLIGENCE
CVE-2026-56742
CVSS score5.9 MEDIUM
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-07-15
Last modified2026-07-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Description
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
Weakness classification
- CWE-862: Missing Authorization
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Vendor Advisory