CVE-2026-56742

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56742
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56742.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56742
Aliases
Downstream
Related
Published
2026-07-15T19:14:07.617Z
Modified
2026-07-20T08:41:37.922542140Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Details

Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56742.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0db95967f554c95ee21a1fb7268bb5785e563d9d
Introduced
274205f001bb24b89d19f0fe7c3fb3aca20030c2
Fixed
617b6b49b57901ea2671e5468b11ac7341e4beb8
Introduced
7c6667e1e707d7f39a4af3409c2a9ebea2917d32
Fixed
20eaccfef029cb046d70219717fb6dbbdf27a59f
Fixed
7422068aff67ac77c7dcc57aa5b9240c91333deb
Fixed
e0b1cef513ff910323f3743e9f3e3d86721e4857
Fixed
f23929cff682d6ed0dc158070812cb302fc0032b
Fixed
fd47963ea394d5e8fa4a88c40a79063430c512ca
Database specific 
{
    "cpe": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.17.17"
        },
        {
            "introduced": "1.18.0"
        },
        {
            "fixed": "1.18.11"
        },
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.19.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.10.0-rc0
1.11.0-rc0
1.11.0-rc1
1.11.0-rc2
1.12.0-rc0
1.12.0-rc1
1.12.0-rc2
1.13.0-rc0
1.13.0-rc1
1.13.0-rc2
1.13.0-rc3
1.14.0-pre.2
1.14.0-rc.0
1.14.0-snapshot.0
1.14.0-snapshot.1
1.14.0-snapshot.2
1.14.0-snapshot.3
1.14.0-snapshot.4
1.15.0-pre.0
1.15.0-pre.1
1.15.0-pre.2
1.15.0-pre.3
1.16.0-pre.0
1.16.0-pre.1
1.16.0-pre.2
1.16.0-pre.3
1.16.0-rc.0
1.17.0
1.17.0-pre.0
1.17.0-pre.1
1.17.0-pre.2
1.17.0-pre.3
1.17.0-rc.0
1.17.0-rc.1
1.17.0-rc.2
1.17.1
1.17.10
1.17.11
1.17.12
1.17.13
1.17.14
1.17.15
1.17.16
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.0-pre.0
1.18.0-pre.1
1.18.0-pre.2
1.18.0-pre.3
1.18.1
1.18.10
1.18.2
1.18.3
1.18.4
1.18.5
1.18.6
1.18.7
1.18.8
1.18.9
1.19.0
1.19.0-pre.0
1.19.0-pre.1
1.19.0-pre.2
1.19.0-pre.3
1.19.0-pre.4
1.19.1
1.19.2
1.19.3
1.19.4
1.20.0-pre.0
1.20.0-pre.1
1.20.0-pre.2
1.20.0-pre.3
1.5.0-rc2
1.8.0-rc1
1.9.0-rc0
1.9.0-rc1
v0.*
v0.10.0
v0.13.1
v0.13.10
v0.13.14
v0.13.15
v0.13.16
v0.13.17
v0.13.18
v0.13.19
v0.13.2
v0.13.20
v0.13.21
v0.13.22
v0.13.25
v0.13.4
v0.13.5
v0.13.6
v0.13.8
v0.8.0
v0.8.2
v0.9.0-rc1
v1.*
v1.0.0-rc1
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9
v1.10.0-rc0
v1.11.0-rc0
v1.11.0-rc1
v1.11.0-rc2
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.13.0-rc0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0-pre.2
v1.14.0-rc.0
v1.14.0-snapshot.0
v1.14.0-snapshot.1
v1.14.0-snapshot.2
v1.14.0-snapshot.3
v1.14.0-snapshot.4
v1.14.0-snapshot.5
v1.15.0-pre.0
v1.15.0-pre.1
v1.15.0-pre.2
v1.15.0-pre.3
v1.16.0-pre.0
v1.16.0-pre.1
v1.16.0-pre.2
v1.16.0-pre.3
v1.16.0-rc.0
v1.17.0
v1.17.0-pre.0
v1.17.0-pre.1
v1.17.0-pre.2
v1.17.0-pre.3
v1.17.0-rc.0
v1.17.0-rc.1
v1.17.0-rc.2
v1.17.1
v1.17.10
v1.17.11
v1.17.12
v1.17.13
v1.17.14
v1.17.15
v1.17.16
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.18.0
v1.18.0-pre.0
v1.18.0-pre.1
v1.18.0-pre.2
v1.18.0-pre.3
v1.18.1
v1.18.10
v1.18.2
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.18.8
v1.18.9
v1.19.0
v1.19.0-pre.0
v1.19.0-pre.1
v1.19.0-pre.2
v1.19.0-pre.3
v1.19.0-pre.4
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.20.0-pre.0
v1.20.0-pre.1
v1.20.0-pre.2
v1.20.0-pre.3
v1.3.0-rc1
v1.5.0-rc1
v1.5.0-rc2
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.7.0-rc1
v1.7.0-rc2
v1.8.0-rc1
v1.9.0-rc0
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56742.json"