BIT-cilium-operator-2026-53935

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/cilium-operator/BIT-cilium-operator-2026-53935.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-cilium-operator-2026-53935
Aliases
Published
2026-07-14T08:41:16Z
Modified
2026-07-14T10:11:29Z
Summary
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
Details

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:cilium:cilium:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / cilium-operator

Package

Name
cilium-operator
Purl
pkg:bitnami/cilium-operator

Severity

  • 6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.17.16
Introduced
1.18.2
Fixed
1.18.10
Introduced
1.19.0
Fixed
1.19.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/cilium-operator/BIT-cilium-operator-2026-53935.json"