CVE-2026-56743 cilium vulnerability
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.
Browse Cloud Security security risksQuick answer
cilium should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- >= 1.19.0, < 1.19.5
Fixed versions
- 1.19.5
How to fix it
Cilium is affected by CVE-2026-56743, an authorization error in selectorless Kubernetes NetworkPolicy ipBlock rules. With a custom clusterName, unintended workloads in the target namespace may be allowed to reach a protected pod. Upgrade Cilium to 1.19.5 or later on the 1.19 branch. Prioritize exposed production systems and accounts that can reach the affected feature.
- Inventory every Cilium deployment, version, exposed endpoint, environment, and owner.
- Check Cilium 1.19.0 through 1.19.4 with a custom clusterName and standard NetworkPolicy peers that use ipBlock without pod or namespace selectors.
- Upgrade Cilium to 1.19.5 or later on the 1.19 branch.
- Until the update is complete, express the equivalent CIDR rule as CiliumNetworkPolicy fromCIDR; CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected.
- Review rendered policy, flow logs, and same-namespace traffic that should have been denied by the CIDR-only rule.
- Remove unintended access paths and rotate service credentials if an unauthorized workload reached a protected service.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm every affected Cilium deployment is on 1.19.5 or a later supported 1.19 release.
- With the custom clusterName, confirm the intended CIDR reaches the target while an arbitrary same-namespace pod is denied and no wildcard namespace allow rule is rendered.
- Confirm Cilium RBAC, network policy, Gateway API objects, node access, and local socket permissions match the cluster's approved security baseline.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-56743.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-56743?
cilium versions listed as affected should be reviewed: >= 1.19.0, < 1.19.5.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.