CVE-2026-41520
Information Disclosure in Cilium via cilium-bugtool
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cloud_native_computing_foundation | cilium | to 1.19.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to the exposure of sensitive data when using the cilium-bugtool on affected Cilium deployments with WireGuard encryption enabled. This could compromise confidentiality and potentially allow attackers or unauthorized users to access sensitive information that should have been protected.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Cilium to versions 1.17.15, 1.18.9, or 1.19.3 or later, where the issue has been patched.
Can you explain this vulnerability to me?
This vulnerability affects Cilium, a networking, observability, and security solution that uses an eBPF-based dataplane. Before versions 1.17.15, 1.18.9, and 1.19.3, the output of the cilium-bugtool could include sensitive data if the tool was run on Cilium deployments with WireGuard encryption enabled. This means that sensitive information could be exposed unintentionally through diagnostic outputs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Cilium's cilium-bugtool prior to versions 1.17.15, 1.18.9, and 1.19.3 can lead to exposure of sensitive data when run against deployments with WireGuard encryption enabled.
Exposure of sensitive data can potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require protection of sensitive information and mandate controls to prevent unauthorized disclosure.
However, the provided information does not specify exact compliance impacts or regulatory assessments related to this vulnerability.