BIT-cilium-operator-2026-56742

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/cilium-operator/BIT-cilium-operator-2026-56742.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-cilium-operator-2026-56742

Aliases

Published

2026-07-19T23:37:51Z

Modified

2026-09-08T08:45:55Z

Summary

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Details

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

Database specific

{
    "cpes": [
        "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / cilium-operator

Package

Name: cilium-operator
Purl: pkg:bitnami/cilium-operator

Severity

8.9 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.17.17

Introduced

1.18.0

Fixed

1.18.11

Introduced

1.19.0

Fixed

1.19.5

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/cilium-operator/BIT-cilium-operator-2026-56742.json"