CVE-2026-49445

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49445
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49445.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49445
Aliases
Downstream
Related
Published
2026-07-15T19:11:55.303Z
Modified
2026-08-04T11:49:29.980819073Z
Severity
  • 9.2 (Critical) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H CVSS Calculator
Summary
Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
Details

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

Database specific 
{
    "cwe_ids": [
        "CWE-732"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49445.json"
}
References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
274205f001bb24b89d19f0fe7c3fb3aca20030c2
Introduced
7c6667e1e707d7f39a4af3409c2a9ebea2917d32
Fixed
6fc7f9725d4a2f3293b17614181ae2b3fb5529cf
Fixed
7d6f03efca0e1df5fcc8face71e35b40ab7a75a0
Fixed
3977f6a1120bf5ec0206c1b3c484ba094da82c7d
Fixed
7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.17.14"
        },
        {
            "introduced": "1.18.0"
        },
        {
            "fixed": "1.18.8"
        },
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.19.2"
        }
    ]
}

Affected versions

1.*
1.10.0-rc0
1.11.0-rc0
1.11.0-rc1
1.11.0-rc2
1.12.0-rc0
1.12.0-rc1
1.12.0-rc2
1.13.0-rc0
1.13.0-rc1
1.13.0-rc2
1.13.0-rc3
1.14.0-pre.2
1.14.0-rc.0
1.14.0-snapshot.0
1.14.0-snapshot.1
1.14.0-snapshot.2
1.14.0-snapshot.3
1.14.0-snapshot.4
1.15.0-pre.0
1.15.0-pre.1
1.15.0-pre.2
1.15.0-pre.3
1.16.0-pre.0
1.16.0-pre.1
1.16.0-pre.2
1.16.0-pre.3
1.16.0-rc.0
1.17.0
1.17.0-pre.0
1.17.0-pre.1
1.17.0-pre.2
1.17.0-pre.3
1.17.0-rc.0
1.17.0-rc.1
1.17.0-rc.2
1.17.1
1.17.10
1.17.11
1.17.12
1.17.13
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.0-pre.0
1.18.0-pre.1
1.18.0-pre.2
1.18.0-pre.3
1.18.1
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.19.0
1.19.0-pre.0
1.19.0-pre.1
1.19.0-pre.2
1.19.0-pre.3
1.19.0-pre.4
1.19.1
1.5.0-rc2
1.8.0-rc1
1.9.0-rc0
1.9.0-rc1
v0.*
v0.10.0
v0.13.1
v0.13.10
v0.13.14
v0.13.15
v0.13.16
v0.13.17
v0.13.18
v0.13.19
v0.13.2
v0.13.20
v0.13.21
v0.13.22
v0.13.25
v0.13.4
v0.13.5
v0.13.6
v0.13.8
v0.8.0
v0.8.2
v0.9.0-rc1
v1.*
v1.0.0-rc1
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9
v1.10.0-rc0
v1.11.0-rc0
v1.11.0-rc1
v1.11.0-rc2
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.13.0-rc0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0-pre.2
v1.14.0-rc.0
v1.14.0-snapshot.0
v1.14.0-snapshot.1
v1.14.0-snapshot.2
v1.14.0-snapshot.3
v1.14.0-snapshot.4
v1.14.0-snapshot.5
v1.15.0-pre.0
v1.15.0-pre.1
v1.15.0-pre.2
v1.15.0-pre.3
v1.16.0-pre.0
v1.16.0-pre.1
v1.16.0-pre.2
v1.16.0-pre.3
v1.16.0-rc.0
v1.17.0
v1.17.0-pre.0
v1.17.0-pre.1
v1.17.0-pre.2
v1.17.0-pre.3
v1.17.0-rc.0
v1.17.0-rc.1
v1.17.0-rc.2
v1.17.1
v1.17.10
v1.17.11
v1.17.12
v1.17.13
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.18.0
v1.18.0-pre.0
v1.18.0-pre.1
v1.18.0-pre.2
v1.18.0-pre.3
v1.18.1
v1.18.2
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.19.0
v1.19.0-pre.0
v1.19.0-pre.1
v1.19.0-pre.2
v1.19.0-pre.3
v1.19.0-pre.4
v1.19.1
v1.3.0-rc1
v1.5.0-rc1
v1.5.0-rc2
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.7.0-rc1
v1.7.0-rc2
v1.8.0-rc1
v1.9.0-rc0
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49445.json"