Traffic Hijacking via Arbitrary ClusterIP in Cilium

Executive Summary

This vulnerability affects Cilium, a networking, observability, and security solution. In certain versions prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users who have the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs using the addressMatcher feature. This allows them to hijack traffic intended for Services in any namespace, bypassing the namespace scoping that is normally enforced by serviceMatcher.

Additionally, deleting such a maliciously crafted policy can corrupt Cilium's internal service state and stop service translation for the affected Service. The issue has been fixed in versions 1.17.16, 1.18.10, and 1.19.4.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves CiliumLocalRedirectPolicies using addressMatcher to override existing Service frontends, potentially hijacking traffic and corrupting service state. Detection would involve inspecting LocalRedirectPolicies for usage of addressMatcher that specify arbitrary ClusterIPs, especially those that conflict with existing Services.

Since the issue is related to policies overriding Service frontends, you can check for LocalRedirectPolicies that use addressMatcher and verify if any ClusterIP addresses in those policies match existing Services in your cluster.

Suggested commands to detect potential exploitation or presence of vulnerable policies include:

• List all CiliumLocalRedirectPolicies and inspect their addressMatcher fields:
• kubectl get ciliumlocalredirectpolicies --all-namespaces -o yaml | grep -A 5 addressMatcher
• List all Services and their ClusterIPs:
• kubectl get svc --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace} {.metadata.name} {.spec.clusterIP}{"\n"}{end}'
• Compare the ClusterIPs used in addressMatcher fields against the ClusterIPs of Services to identify conflicts.

Additionally, check Cilium logs for warnings about LocalRedirectPolicies being rejected due to address conflicts, as newer versions log warnings when addressMatcher tries to override existing Services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with permissions to create CiliumLocalRedirectPolicies to hijack network traffic intended for services in any namespace, potentially redirecting or intercepting sensitive data.

Furthermore, deleting such a malicious policy can corrupt the internal service state of Cilium, causing service translation to stop for the affected service, which can lead to denial of service or disruption of network communications.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly address how CVE-2026-53935 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Cilium to one of the fixed versions: 1.17.16, 1.18.10, or 1.19.4.

Avoid allowing users to create CiliumLocalRedirectPolicies until the upgrade is applied, as these policies can be exploited to hijack traffic and corrupt internal service state.

Useful 0 Not Useful 0