https://vulnerability.circl.lu/sightings/feed 2026-09-26T01:55:33.368136+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c61418fd-fe91-4748-a8da-886309c77003/export 2026-09-26T01:55:33.397498+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c61418fd-fe91-4748-a8da-886309c77003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56742", "type": "seen", "source": "https://gist.github.com/alon710/ede21d9eee467eb023b3dac26fbd4240", "content": "# CVE-2026-56742: CVE-2026-56742: Missing ReferenceGrant Authorization Check in Cilium Gateway API Request Mirroring\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56742\n\n## Summary\nCilium, a cloud-native networking and security solution for Kubernetes, contains a security bypass vulnerability in its translation engine for Gateway API resources. When parsing HTTPRoute and GRPCRoute configurations, the Cilium Operator fails to apply ReferenceGrant authorization checks to RequestMirror filters. This flaw allows a user with restricted namespace-level permissions to mirror and route traffic to services across namespace boundaries without authorization, leading to cross-namespace data leaks.\n\n## TL;DR\nA validation bypass in Cilium's Gateway API controller allows namespaced users to configure traffic mirroring filters that copy and redirect live request streams to unauthorized services in other namespaces, bypassing the Kubernetes Gateway API ReferenceGrant security boundary.\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00276\n- **Impact**: Security Bypass and Cross-Namespace Traffic Mirroring\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Cilium v1.17.x before v1.17.17\n- Cilium v1.18.x before v1.18.11\n- Cilium v1.19.x before v1.19.5\n- **Cilium**: >= 1.17.0, < 1.17.17 (Fixed in: `v1.17.17`)\n- **Cilium**: >= 1.18.0, < 1.18.11 (Fixed in: `v1.18.11`)\n- **Cilium**: >= 1.19.0, < 1.19.5 (Fixed in: `v1.19.5`)\n\n## Mitigation\n\n- Upgrade Cilium to patched releases (v1.17.17, v1.18.11, or v1.19.5)\n- Disable Kubernetes Gateway API functionality if it is not actively required\n- Restrict RBAC permissions for creating or updating HTTPRoute and GRPCRoute resources across the cluster\n- Regularly audit HTTPRoute and GRPCRoute configurations for cross-namespace request-mirror definitions without associated ReferenceGrants\n\n**Remediation Steps:**\n1. Identify the current Cilium version deployed in the Kubernetes cluster.\n2. Apply the upgraded Cilium deployment manifests or Helm charts using target versions v1.17.17+, v1.18.11+, or v1.19.5+.\n3. Verify that the Cilium Operator pods and agent daemonsets have restarted and are running the updated version.\n4. Execute audit queries to check for any active HTTPRoute or GRPCRoute objects utilizing cross-namespace mirrors.\n\n## References\n\n- [Cilium Security Advisory GHSA-w7c2-w76w-5hmj](https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj)\n- [CVE-2026-56742 Record](https://www.cve.org/CVERecord?id=CVE-2026-56742)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-56742)\n- [Cilium v1.17.17 Release](https://github.com/cilium/cilium/releases/tag/v1.17.17)\n- [Cilium v1.18.11 Release](https://github.com/cilium/cilium/releases/tag/v1.18.11)\n- [Cilium v1.19.5 Release](https://github.com/cilium/cilium/releases/tag/v1.19.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56742) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T11:30:32.000000Z"} 2026-09-25T11:30:32+00:00