CVE-2026-49445

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Cilium via Admin Socket Exposure

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-49445

Affected Vendors & Products

Vendor	Product	Version / Range
cilium	cilium	to 1.17.14 (exc)
cilium	cilium	From 1.18.0 (inc) to 1.18.8 (exc)
cilium	cilium	From 1.19.0 (inc) to 1.19.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

CVE-2026-49445 is a critical vulnerability in Cilium where the Envoy admin socket (admin.sock) is created with world-accessible permissions when Cilium's Layer 7 functionality is enabled. This allows local attackers to access sensitive admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy processes.

Detection Guidance

Check for a world-accessible admin.sock file in Cilium/Envoy deployments. Use commands like 'ls -la /var/run/cilium/envoy/admin.sock' or 'find / -name admin.sock 2>/dev/null' to locate the socket. Verify permissions with 'stat -c %a /path/to/admin.sock' where 0660 or stricter is expected.

Impact Analysis

A local attacker could exploit this to access Envoy admin endpoints, exposing TLS secrets, disrupting cluster traffic, or terminating Envoy processes. This could lead to data breaches, service disruptions, or unauthorized control over the cluster's networking and security functions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as TLS secrets, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance could be compromised due to potential data exposure and lack of proper access controls.

Mitigation Strategies

Upgrade Cilium to versions 1.17.14, 1.18.8, or 1.19.2 or later. If upgrading is not immediately possible, disable Cilium's L7 functionality as a temporary workaround. Monitor for unauthorized access to admin.sock endpoints.

Hi! I’m here to help you understand CVE-2026-49445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70