CVE-2026-56743: Cilium

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

Affected products

• Cilium Cilium: from 1.19.0, before 1.19.5 (fixed in 1.19.5)

Published 2026-07-15. Last modified 2026-07-17.