---
id: CVE-2026-53935
aliases:
  - GHSA-q6h5-q3q6-f87x
title: >-
  CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service
  traffic hijacking and can break service translation
summary: >-
  CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service
  traffic hijacking and can break service translation
severity: medium
cvss: 6.9
cwe:
  - CWE-601
vendor: cilium
product: github.com/cilium/cilium
ecosystem: go
affected:
  - 'github.com/cilium/cilium >= 1.19.0, < 1.19.4'
  - 'github.com/cilium/cilium >= 1.18.2, < 1.18.10'
  - github.com/cilium/cilium < 1.17.16
patched:
  - github.com/cilium/cilium 1.19.4
  - github.com/cilium/cilium 1.18.10
  - github.com/cilium/cilium 1.17.16
published: '2026-07-06'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q6h5-q3q6-f87x'
references:
  - url: 'https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x'
  - url: 'https://github.com/cilium/cilium/pull/44512'
  - url: 'https://github.com/cilium/cilium/pull/44584'
  - url: 'https://github.com/cilium/cilium/pull/44585'
  - url: 'https://github.com/advisories/GHSA-q6h5-q3q6-f87x'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-06T20:46:12.545Z'
epss: 0.0034
epssPercentile: 0.24708
---

## Overview

### Impact

Users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, which enables hijacking traffic to Services in any namespace, bypassing the namespace-scoping guarantees enforced by serviceMatcher.

In addition, deleting such a policy can corrupt Cilium's internal service state, causing service translation to stop working entirely for the affected Service.

### Patches

This issue affects:

- Cilium v1.19.0 to v1.19.3 inclusive  (fixed in PR #45584)
- Cilium v1.18.2 to v1.18.9 inclusive (fixed in PR #45585)
- All versions of Cilium prior to v1.17.16 (fixed in PR #45412)

This issue has been patched in:

- Cilium v1.19.4
- Cilium v1.18.10
- Cilium v1.17.16

### Workarounds

There is no workaround to this issue.

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @ysksuzuki for investigating and fixing the issue.

### For more information
If there are any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/).

To report potential vulnerabilities affecting Cilium, it strongly is encouraged to report them through the security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and reports will be treated as a top priority.

## Affected packages

- `github.com/cilium/cilium >= 1.19.0, < 1.19.4`
- `github.com/cilium/cilium >= 1.18.2, < 1.18.10`
- `github.com/cilium/cilium < 1.17.16`

## Remediation

Upgrade to a patched release:

- `github.com/cilium/cilium 1.19.4`
- `github.com/cilium/cilium 1.18.10`
- `github.com/cilium/cilium 1.17.16`