CVE-2026-33726
published 2026-03-27CVE-2026-33726: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network…
PriorityP421medium4.3CVSS 3.1
AVAACLPRNUINSUCNILAN
EPSS
0.24%
15.9th percentile
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI (`alibabacloud.enabled`), Azure IPAM (`azure.enabled`, but not AKS BYOCNI), and some GKE deployments (`gke.enabled`; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment. Versions 1.17.14, 1.18.8, and 1.19.2 contain a patch. There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cilium | cilium | < 1.17.14 | 1.17.14 |
| cilium | cilium | — | — |
| cilium | cilium | — | — |
| cilium | cilium | >= 1.18.0 < 1.18.8 | 1.18.8 |
| cilium | cilium | >= 1.19.0 < 1.19.2 | 1.19.2 |
| github.com | cilium_cilium | >= 0 < 1.17.14 | 1.17.14 |
| github.com | cilium_cilium | >= 1.18.0 < 1.18.8 | 1.18.8 |
| github.com | cilium_cilium | >= 1.19.0 < 1.19.2 | 1.19.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
osv·2026-03-26
CVE-2026-33726 [MEDIUM] Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
### Impact
Ingress [Network Policies](https://docs.cilium.io/en/stable/network/kubernetes/policy/#network-policy) are not enforced for traffic from pods to L7 Services ([Envoy](https://docs.cilium.io/en/stable/network/servicemesh/l7-traffic-management), GAMMA) with a local backend on the same node, when [Per-Endpoint Routing](https://docs.cilium.io/en/stable/network/concepts/routing/#routing) is enabled and [BPF Host Routing](https://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routing) is disabled.
Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI (`alibabacloud.enabled`), Az
OSV
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
osv·2026-03-26
CVE-2026-33726 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GHSA
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
ghsa·2026-03-26
CVE-2026-33726 [MEDIUM] CWE-284 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
### Impact
Ingress [Network Policies](https://docs.cilium.io/en/stable/network/kubernetes/policy/#network-policy) are not enforced for traffic from pods to L7 Services ([Envoy](https://docs.cilium.io/en/stable/network/servicemesh/l7-traffic-management), GAMMA) with a local backend on the same node, when [Per-Endpoint Routing](https://docs.cilium.io/en/stable/network/concepts/routing/#routing) is enabled and [BPF Host Routing](https://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routing) is disabled.
Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI (`alibabacloud.enabled`), Az
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-33726 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.4
CVE-2026-33726 [LOW] CVE-2026-33726 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33726 :
Cilium vulnerability analysis and mitigation
eni.enabled
alibabacloud.enabled
azure.enabled
gke.enabled
Source : NVD
## 4.3
Score
Published March 27, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Cilium
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kubescape-operator
kubescape-operator-fips
Sources
Chainguard Has Fix Added at: Mar 29, 2026
GoLang Severity MEDIUM Has Fix Added at: Mar 29, 2026
MinimOS Severity MEDIUM Has Fix Added at: Mar 29, 2026
Linux Severity MEDIUM Has Fix Added at: Mar 29, 2026
Wolfi Has Fix Added at: Mar 29, 2026
Linux Severity MEDIUM Has F
Wiz
CVE-2026-26963 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.4
CVE-2026-26963 [LOW] CVE-2026-26963 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26963 :
Cilium vulnerability analysis and mitigation
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
Source : NVD
## 5.4
Score
Published February 20, 2026
Severity MEDIUM
CNA Score 6.1
Affected Technologies
Cilium
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
github.com/cilium/cilium
cilium-1.18
Sources
GoLang Severity MEDIUM Has Fix Added at: Feb 20,
https://docs.cilium.io/en/stable/network/concepts/routing/#routinghttps://docs.cilium.io/en/stable/network/kubernetes/policy/#network-policyhttps://docs.cilium.io/en/stable/network/servicemesh/l7-traffic-managementhttps://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routinghttps://github.com/cilium/cilium/pull/44693https://github.com/cilium/cilium/security/advisories/GHSA-hxv8-4j4r-cqgv
2026-03-27
Published