{"id":"CVE-2026-56743","aliases":["GHSA-fm8w-2m5w-9j7r"],"title":"Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match","summary":"Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match","severity":"medium","cvss":5.4,"cwe":["CWE-863"],"vendor":"cilium","product":"github.com/cilium/cilium","ecosystem":"go","affected":["github.com/cilium/cilium >= 1.19.0, < 1.19.5"],"patched":["github.com/cilium/cilium 1.19.5"],"published":"2026-09-03","updated":"2026-09-03","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fm8w-2m5w-9j7r","references":[{"url":"https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56743"},{"url":"https://github.com/cilium/cilium/pull/46305"},{"url":"https://github.com/cilium/cilium/pull/46456"},{"url":"https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8"},{"url":"https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171"},{"url":"https://github.com/cilium/cilium/releases/tag/v1.19.5"},{"url":"https://github.com/advisories/GHSA-fm8w-2m5w-9j7r"}],"tags":["ghsa","go"],"epss":0.00248,"epssPercentile":0.16436,"ingestedAt":"2026-09-03T18:06:42.114Z","slug":"CVE-2026-56743","body":"## Overview\n\n### Impact\n\nStandard Kubernetes `NetworkPolicy` specifications using CIDR-based `ipBlock` rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.\n\nWhen Cilium deployment is configured with a specific custom `clusterName` (rather than the default `\"any\"` value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.\n\nExample policy affected by this issue:\n```\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-server\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: test-server\n  policyTypes:\n  - Ingress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 192.0.2.3\n```\n\nIn affected versions, this policy erroneously allows the `test-server` Pod in the `default` namespace to receive any traffic from other workloads running in the `default` namespace.\n\n### Patches\n\nThis issue has been patched in:\n\n- Cilium v1.19.5\n\nReleases below v1.19.0 are not affected.\n\n### This issue affects:\n\n- Cilium v1.19 between v1.19.0 and v1.19.4 inclusive\n\n### Workarounds\n\nDevelopers can create the equivalent policy using CiliumNetworkPolicy [fromCIDR expressions](https://docs.cilium.io/en/stable/security/policy/layer3/#ip-cidr-based). CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected by this issue.\n\n### Acknowledgements\n\nSpecial thanks to @TheBeeZee for reporting this issue and preparing the fix, and to @fristonio and @odinuge for their assistance in reviewing the solution.\n\n### For more information\n\nIf a vulnerability affecting Cilium appears to have been found, the Cilium security team strongly encourages reporting it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.\n\n## Affected packages\n\n- `github.com/cilium/cilium >= 1.19.0, < 1.19.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/cilium/cilium 1.19.5`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}