CVE-2026-56743

Analyzed Analyzed - Analysis Complete

Heap Overflow in Cilium NetworkPolicy with Custom ClusterName

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-56743

EUVD

EUVD-2026-44774

Affected Vendors & Products

Vendor	Product	Version / Range
cilium	cilium	From 1.19.0 (inc) to 1.19.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-56743 is a vulnerability in Cilium versions 1.19.0 to 1.19.4 where Kubernetes NetworkPolicy rules using CIDR-based ipBlock without pod or namespace selectors incorrectly allow traffic from other workloads in the same namespace due to a wildcard namespace rule. This occurs when Cilium uses a custom clusterName instead of the default value.

Detection Guidance

To detect this vulnerability, check if your Cilium version is between 1.19.0 and 1.19.4. Run 'cilium version' to verify the installed version. Inspect Kubernetes NetworkPolicy resources for ipBlock rules without pod or namespace selectors, especially in deployments using a custom clusterName. Look for unintended wildcard namespace allow rules in policy definitions.

Impact Analysis

This vulnerability could allow unauthorized network traffic between namespaces, bypassing intended network policies. Attackers with low privileges could exploit this to access restricted resources in the same namespace, potentially leading to data leaks or unauthorized actions.

Compliance Impact

This vulnerability may violate compliance requirements for network isolation and access control, such as those in GDPR (data protection) and HIPAA (healthcare data). Unauthorized cross-namespace traffic could lead to data breaches, resulting in regulatory penalties or loss of certification.

Mitigation Strategies

Upgrade Cilium to version 1.19.5 or later immediately. Alternatively, replace standard Kubernetes NetworkPolicy with CiliumNetworkPolicy using CIDR expressions to avoid the issue. Review and correct any existing NetworkPolicy configurations to ensure proper selector usage.

Hi! I’m here to help you understand CVE-2026-56743. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70