CVE-2026-49445: cilium

csirt@kutim:~/threat-intel/cve/CVE-2026-49445

CVSS 8.8 · High EPSS 0,17%

Kerentanan Incorrect Permission Assignment for Critical Resource pada cilium. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

Rincian

Terbit di NVD: 15 Juli 2026
Terakhir diubah: 17 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-732: Incorrect Permission Assignment for Critical Resource
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cilium	cilium	Semua versi sebelum 1.17.14
cilium	cilium	Versi 1.18.0 hingga sebelum 1.18.8
cilium	cilium	Versi 1.19.0 hingga sebelum 1.19.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9 patch · advisory vendor
https://github.com/cilium/cilium/commit/7bfbdd5c1be83d6c9ba3e089b4c804b6603505b6 patch
https://github.com/cilium/cilium/pull/44512 patch
https://github.com/cilium/cilium/releases/tag/v1.17.14 release notes
https://github.com/cilium/cilium/releases/tag/v1.18.8 release notes
https://github.com/cilium/cilium/releases/tag/v1.19.2 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.