CVE-2026-33726

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33726
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33726.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33726
Aliases
Downstream
Related
Published
2026-03-27T00:23:21.795Z
Modified
2026-04-06T08:40:57.963093141Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
Details

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (eni.enabled), AlibabaCloud ENI (alibabacloud.enabled), Azure IPAM (azure.enabled, but not AKS BYOCNI), and some GKE deployments (gke.enabled; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment. Versions 1.17.14, 1.18.8, and 1.19.2 contain a patch. There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33726.json"
}
References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6fc7f9725d4a2f3293b17614181ae2b3fb5529cf
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.17.14"
        }
    ]
}
Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
274205f001bb24b89d19f0fe7c3fb3aca20030c2
Fixed
7d6f03efca0e1df5fcc8face71e35b40ab7a75a0
Database specific 
{
    "versions": [
        {
            "introduced": "1.18.0"
        },
        {
            "fixed": "1.18.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
7c6667e1e707d7f39a4af3409c2a9ebea2917d32
Fixed
3977f6a1120bf5ec0206c1b3c484ba094da82c7d
Database specific 
{
    "versions": [
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.19.2"
        }
    ]
}

Affected versions

0.*
0.10.1
1.*
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.10.0
1.10.0-rc0
1.10.0-rc1
1.10.0-rc2
1.10.1
1.10.10
1.10.11
1.10.12
1.10.13
1.10.14
1.10.15
1.10.16
1.10.17
1.10.18
1.10.19
1.10.2
1.10.20
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.10.8
1.10.9
1.11.0
1.11.0-rc0
1.11.0-rc1
1.11.0-rc2
1.11.0-rc3
1.11.1
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.16
1.11.17
1.11.18
1.11.19
1.11.2
1.11.20
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.12.0
1.12.0-rc0
1.12.0-rc1
1.12.0-rc2
1.12.0-rc3
1.12.1
1.12.10
1.12.11
1.12.12
1.12.13
1.12.14
1.12.15
1.12.16
1.12.17
1.12.18
1.12.19
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.12.9
1.13.0
1.13.0-rc0
1.13.0-rc1
1.13.0-rc2
1.13.0-rc3
1.13.0-rc4
1.13.0-rc5
1.13.1
1.13.10
1.13.11
1.13.12
1.13.13
1.13.14
1.13.15
1.13.16
1.13.17
1.13.18
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.13.7
1.13.8
1.13.9
1.14.0
1.14.0-pre.2
1.14.0-rc.0
1.14.0-rc.1
1.14.0-snapshot.0
1.14.0-snapshot.1
1.14.0-snapshot.2
1.14.0-snapshot.3
1.14.0-snapshot.4
1.14.1
1.14.10
1.14.11
1.14.12
1.14.13
1.14.14
1.14.15
1.14.16
1.14.17
1.14.18
1.14.19
1.14.2
1.14.3
1.14.4
1.14.5
1.14.6
1.14.7
1.14.8
1.14.9
1.15.0
1.15.0-pre.0
1.15.0-pre.1
1.15.0-pre.2
1.15.0-pre.3
1.15.0-rc.0
1.15.0-rc.1
1.15.1
1.15.10
1.15.11
1.15.12
1.15.13
1.15.14
1.15.15
1.15.16
1.15.17
1.15.18
1.15.19
1.15.2
1.15.3
1.15.4
1.15.5
1.15.6
1.15.7
1.15.8
1.15.9
1.16.0
1.16.0-pre.0
1.16.0-pre.1
1.16.0-pre.2
1.16.0-pre.3
1.16.0-rc.0
1.16.0-rc.1
1.16.0-rc.2
1.16.1
1.16.10
1.16.11
1.16.12
1.16.13
1.16.14
1.16.15
1.16.16
1.16.17
1.16.18
1.16.19
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.0-pre.0
1.17.0-pre.1
1.17.0-pre.2
1.17.0-pre.3
1.17.0-rc.0
1.17.0-rc.1
1.17.0-rc.2
1.17.1
1.17.10
1.17.11
1.17.12
1.17.13
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.0-pre.0
1.18.0-pre.1
1.18.0-pre.2
1.18.0-pre.3
1.18.0-rc.0
1.18.0-rc.1
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.19.0
1.19.0-pre.0
1.19.0-pre.1
1.19.0-pre.2
1.19.0-pre.3
1.19.0-pre.4
1.19.0-rc.0
1.19.0-rc.1
1.19.1
1.19.2
1.2.0
1.2.0-rc1
1.2.0-rc2
1.2.0-rc3
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.20.0-pre.0
1.20.0-pre.1
1.3.0
1.3.0-rc4
1.3.0-rc5
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.4.0
1.4.0-rc2
1.4.0-rc5
1.4.0-rc6
1.4.0-rc7
1.4.0-rc8
1.4.0-rc9
1.4.1
1.4.10
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.0
1.5.0-rc2
1.5.0-rc3
1.5.0-rc4
1.5.0-rc5
1.5.0-rc6
1.5.1
1.5.10
1.5.11
1.5.12
1.5.13
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.1
1.6.10
1.6.11
1.6.12
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.0-rc3
1.7.0-rc4
1.7.1
1.7.10
1.7.11
1.7.12
1.7.13
1.7.14
1.7.15
1.7.16
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8
1.7.9
1.8.0
1.8.0-rc1
1.8.0-rc2
1.8.0-rc3
1.8.0-rc4
1.8.1
1.8.10
1.8.11
1.8.12
1.8.13
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.9.0
1.9.0-rc0
1.9.0-rc1
1.9.0-rc2
1.9.0-rc3
1.9.1
1.9.10
1.9.11
1.9.12
1.9.13
1.9.14
1.9.15
1.9.16
1.9.17
1.9.18
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
v0.*
v0.10.0
v0.11
v0.12.0
v0.13.1
v0.13.10
v0.13.11
v0.13.12
v0.13.13
v0.13.14
v0.13.15
v0.13.16
v0.13.17
v0.13.18
v0.13.19
v0.13.2
v0.13.20
v0.13.21
v0.13.22
v0.13.23
v0.13.24
v0.13.25
v0.13.28
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.13.8
v0.13.9
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.0-rc1
v1.*
v1.0.0
v1.0.0-rc1
v1.0.0-rc10
v1.0.0-rc11
v1.0.0-rc13
v1.0.0-rc14
v1.0.0-rc2
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.1.0
v1.1.0-rc0
v1.1.0-rc1
v1.1.0-rc2
v1.1.0-rc3
v1.1.0-rc4
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.10.0
v1.10.0-rc0
v1.10.0-rc1
v1.10.0-rc2
v1.10.1
v1.10.10
v1.10.11
v1.10.12
v1.10.13
v1.10.14
v1.10.15
v1.10.16
v1.10.17
v1.10.18
v1.10.19
v1.10.2
v1.10.20
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.11.0
v1.11.0-rc0
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.11.1
v1.11.10
v1.11.11
v1.11.12
v1.11.13
v1.11.14
v1.11.15
v1.11.16
v1.11.17
v1.11.18
v1.11.19
v1.11.2
v1.11.20
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.11.7
v1.11.8
v1.11.9
v1.12.0
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.12.1
v1.12.10
v1.12.11
v1.12.12
v1.12.13
v1.12.14
v1.12.15
v1.12.16
v1.12.17
v1.12.18
v1.12.19
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.13.0
v1.13.0-rc0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.13.0-rc4
v1.13.0-rc5
v1.13.1
v1.13.10
v1.13.11
v1.13.12
v1.13.13
v1.13.14
v1.13.15
v1.13.16
v1.13.17
v1.13.18
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.14.0
v1.14.0-pre.2
v1.14.0-rc.0
v1.14.0-rc.1
v1.14.0-snapshot.0
v1.14.0-snapshot.1
v1.14.0-snapshot.2
v1.14.0-snapshot.3
v1.14.0-snapshot.4
v1.14.0-snapshot.5
v1.14.0-snapshot.6
v1.14.1
v1.14.10
v1.14.11
v1.14.12
v1.14.13
v1.14.14
v1.14.15
v1.14.16
v1.14.17
v1.14.18
v1.14.19
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.14.9
v1.15.0
v1.15.0-pre.0
v1.15.0-pre.1
v1.15.0-pre.2
v1.15.0-pre.3
v1.15.0-rc.0
v1.15.0-rc.1
v1.15.1
v1.15.10
v1.15.11
v1.15.12
v1.15.13
v1.15.14
v1.15.15
v1.15.16
v1.15.17
v1.15.18
v1.15.19
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.15.9
v1.16.0
v1.16.0-pre.0
v1.16.0-pre.1
v1.16.0-pre.2
v1.16.0-pre.3
v1.16.0-rc.0
v1.16.0-rc.1
v1.16.0-rc.2
v1.16.1
v1.16.10
v1.16.11
v1.16.12
v1.16.13
v1.16.14
v1.16.15
v1.16.16
v1.16.17
v1.16.18
v1.16.19
v1.16.2
v1.16.3
v1.16.4
v1.16.5
v1.16.6
v1.16.7
v1.16.8
v1.16.9
v1.17.0
v1.17.0-pre.0
v1.17.0-pre.1
v1.17.0-pre.2
v1.17.0-pre.3
v1.17.0-rc.0
v1.17.0-rc.1
v1.17.0-rc.2
v1.17.1
v1.17.10
v1.17.11
v1.17.12
v1.17.13
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.18.0
v1.18.0-pre.0
v1.18.0-pre.1
v1.18.0-pre.2
v1.18.0-pre.3
v1.18.0-rc.0
v1.18.0-rc.1
v1.18.1
v1.18.2
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.18.8
v1.19.0
v1.19.0-pre.0
v1.19.0-pre.1
v1.19.0-pre.2
v1.19.0-pre.3
v1.19.0-pre.4
v1.19.0-rc.0
v1.19.0-rc.1
v1.19.1
v1.19.2
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.2.1
v1.2.2
v1.2.2-hf1
v1.2.3
v1.2.4
v1.2.4-rc1
v1.2.4-rc3
v1.2.4-rc4
v1.2.5
v1.2.5-rc1
v1.2.5-rc2
v1.2.5-rc3
v1.2.6
v1.2.6-rc1
v1.2.6-rc2
v1.2.6-rc3
v1.2.7
v1.2.8
v1.20.0-pre.0
v1.20.0-pre.1
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.3.0-rc3
v1.3.0-rc4
v1.3.0-rc5
v1.3.1
v1.3.1-rc1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.4.0-rc4
v1.4.0-rc5
v1.4.0-rc6
v1.4.0-rc7
v1.4.0-rc8
v1.4.0-rc9
v1.4.1
v1.4.10
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.5.0-rc5
v1.5.0-rc6
v1.5.1
v1.5.1-rc1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.2
v1.5.2-rc1
v1.5.2-rc2
v1.5.3
v1.5.4
v1.5.5
v1.5.5-rc1
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.6.0-rc4
v1.6.0-rc5
v1.6.0-rc6
v1.6.0-rc7
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.0-rc1
v1.7.0-rc2
v1.7.0-rc3
v1.7.0-rc4
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.0-rc1
v1.8.0-rc2
v1.8.0-rc3
v1.8.0-rc4
v1.8.1
v1.8.10
v1.8.11
v1.8.12
v1.8.13
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.0-rc0
v1.9.0-rc1
v1.9.0-rc2
v1.9.0-rc3
v1.9.1
v1.9.10
v1.9.11
v1.9.12
v1.9.13
v1.9.14
v1.9.15
v1.9.16
v1.9.17
v1.9.18
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33726.json"