CVE-2026-53935

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.9 / 10

Vector String

                                        CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H                                    

Vulnerability Description

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.

Vulnerability Details

Published Date

July 06, 2026

Last Modified

July 10, 2026

CWE ID

CWE-863

Source

GitHub

Vendor

Product

github.com/cilium/cilium

External References

https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x
https://github.com/cilium/cilium/pull/44512
https://github.com/cilium/cilium/pull/44584
https://github.com/cilium/cilium/pull/44585
https://github.com/advisories/GHSA-q6h5-q3q6-f87x

CVE-2026-53935

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment