DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-56742: CVE-2026-56742: Missing ReferenceGrant Authorization Check in Cilium Gateway API Request Mirroring

#security #cve #cybersecurity

CVE-2026-56742: Missing ReferenceGrant Authorization Check in Cilium Gateway API Request Mirroring

Vulnerability ID: CVE-2026-56742
CVSS Score: 5.9
Published: 2026-09-24

Cilium, a cloud-native networking and security solution for Kubernetes, contains a security bypass vulnerability in its translation engine for Gateway API resources. When parsing HTTPRoute and GRPCRoute configurations, the Cilium Operator fails to apply ReferenceGrant authorization checks to RequestMirror filters. This flaw allows a user with restricted namespace-level permissions to mirror and route traffic to services across namespace boundaries without authorization, leading to cross-namespace data leaks.

TL;DR

A validation bypass in Cilium's Gateway API controller allows namespaced users to configure traffic mirroring filters that copy and redirect live request streams to unauthorized services in other namespaces, bypassing the Kubernetes Gateway API ReferenceGrant security boundary.

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Adjacent Network (AV:A)
  • CVSS Score: 5.9 (Medium)
  • EPSS Score: 0.00276
  • Impact: Security Bypass and Cross-Namespace Traffic Mirroring
  • Exploit Status: none
  • KEV Status: Not Listed

Affected Systems

  • Cilium v1.17.x before v1.17.17
  • Cilium v1.18.x before v1.18.11
  • Cilium v1.19.x before v1.19.5
  • Cilium: >= 1.17.0, < 1.17.17 (Fixed in: v1.17.17)
  • Cilium: >= 1.18.0, < 1.18.11 (Fixed in: v1.18.11)
  • Cilium: >= 1.19.0, < 1.19.5 (Fixed in: v1.19.5)

Code Analysis

Commit: 7422068

Enforce ReferenceGrant check for RequestMirror HTTPRoute and GRPCRoute filters

Commit: e0b1cef

Fix ReferenceGrant verification for route mirroring in Cilium Gateway operator

Commit: f23929c

Ensure Gateway API traffic mirroring undergoes ReferenceGrant validation

Commit: fd47963

Backport ReferenceGrant validation fixes to Gateway API parser

Mitigation Strategies

  • Upgrade Cilium to patched releases (v1.17.17, v1.18.11, or v1.19.5)
  • Disable Kubernetes Gateway API functionality if it is not actively required
  • Restrict RBAC permissions for creating or updating HTTPRoute and GRPCRoute resources across the cluster
  • Regularly audit HTTPRoute and GRPCRoute configurations for cross-namespace request-mirror definitions without associated ReferenceGrants

Remediation Steps:

  1. Identify the current Cilium version deployed in the Kubernetes cluster.
  2. Apply the upgraded Cilium deployment manifests or Helm charts using target versions v1.17.17+, v1.18.11+, or v1.19.5+.
  3. Verify that the Cilium Operator pods and agent daemonsets have restarted and are running the updated version.
  4. Execute audit queries to check for any active HTTPRoute or GRPCRoute objects utilizing cross-namespace mirrors.

References

Read the full report for CVE-2026-56742 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)