Cilium CVE-2026-4945: Critical Local Envoy Admin Socket Info Disclosure and Cluster Disruption

Vulnerability Overview Vulnerability Name: Sensitive information disclosure and cluster disruption via local Envoy admin socket access Severity: Critical (9.2 / 10) CVE ID: CVE-2026-4945 CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: Low - Availability: High Affected Versions Affected Versions: - >= 1.19.0, = 1.18.0, < 1.18.8 - < 1.17.14 Impact Description: - When Cilium L7 features are enabled on a cluster, the Envoy instances supporting these features create a world-accessible socket on the cluster nodes. - A local attacker can access the Envoy admin endpoints, which, depending on the deployment configuration, may expose sensitive information or allow destructive administrative operations, such as: - Exposing TLS keys - Disrupting traffic within the cluster - Terminating the Envoy process - This issue affects both embedded and standalone Envoy deployment models. Remediation Fixed Versions: - 1.19.2 - 1.18.8 - 1.17.14 Patch Information: - This issue was fixed in #44512 and is included in the following versions: - Cilium v1.19.2 - Cilium v1.18.8 - Cilium v1.17.14 Workarounds: - No known workarounds are currently available. Acknowledgments The Cilium community and members of Isovalent collaborated to prepare these mitigations. Special thanks to moemen for reporting the issue, and to 0xchz for their work in investigating and fixing this problem. More Information If you have any questions or comments, please contact us via Slack. If you discover a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list intended solely for the Cilium Security Team, and your report will be treated with the highest priority.

Goal Reached Thanks to every supporter — we hit 100%!

Cilium CVE-2026-4945: Critical Local Envoy Admin Socket Info Disclosure and Cluster Disruption

More from this source