{"id":"GHSA-fm8w-2m5w-9j7r","summary":"Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match","details":"### Impact\n\nStandard Kubernetes `NetworkPolicy` specifications using CIDR-based `ipBlock` rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.\n\nWhen Cilium deployment is configured with a specific custom `clusterName` (rather than the default `\"any\"` value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.\n\nExample policy affected by this issue:\n```\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-server\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: test-server\n  policyTypes:\n  - Ingress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 192.0.2.3\n```\n\nIn affected versions, this policy erroneously allows the `test-server` Pod in the `default` namespace to receive any traffic from other workloads running in the `default` namespace.\n\n### Patches\n\nThis issue has been patched in:\n\n- Cilium v1.19.5\n\nReleases below v1.19.0 are not affected.\n\n### This issue affects:\n\n- Cilium v1.19 between v1.19.0 and v1.19.4 inclusive\n\n### Workarounds\n\nDevelopers can create the equivalent policy using CiliumNetworkPolicy [fromCIDR expressions](https://docs.cilium.io/en/stable/security/policy/layer3/#ip-cidr-based). CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected by this issue.\n\n### Acknowledgements\n\nSpecial thanks to @TheBeeZee for reporting this issue and preparing the fix, and to @fristonio and @odinuge for their assistance in reviewing the solution.\n\n### For more information\n\nIf a vulnerability affecting Cilium appears to have been found, the Cilium security team strongly encourages reporting it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.","aliases":["BIT-cilium-2026-56743","BIT-cilium-operator-2026-56743","BIT-hubble-relay-2026-56743","CVE-2026-56743","GO-2026-6367"],"modified":"2026-09-10T15:25:46.705724500Z","published":"2026-09-03T17:17:47Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-03T17:17:47Z","nvd_published_at":"2026-07-15T20:17:51Z","cwe_ids":["CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56743"},{"type":"WEB","url":"https://github.com/cilium/cilium/pull/46305"},{"type":"WEB","url":"https://github.com/cilium/cilium/pull/46456"},{"type":"WEB","url":"https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8"},{"type":"WEB","url":"https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171"},{"type":"PACKAGE","url":"https://github.com/cilium/cilium"},{"type":"WEB","url":"https://github.com/cilium/cilium/releases/tag/v1.19.5"}],"affected":[{"package":{"name":"github.com/cilium/cilium","ecosystem":"Go","purl":"pkg:golang/github.com/cilium/cilium"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.19.0"},{"fixed":"1.19.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fm8w-2m5w-9j7r/GHSA-fm8w-2m5w-9j7r.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}