https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:18:12.837536+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-4489 EUVD-2026-4489 2026-10-04T06:18:12.923593+00:00 EUVD-2026-4489 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28250 fkie_cve-2024-28250 2026-10-04T06:18:12.923635+00:00

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-v6q2-4qr3-5cw6 GHSA-v6q2-4qr3-5cw6 — Unencrypted traffic between nodes when using WireGuard and L7 policies 2026-10-04T06:18:12.923673+00:00

Affected: Go: github.com/cilium/cilium

### Impact

In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies:

- Traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes. - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS proxy and pods on other nodes.

### Patches

This issue affects:

* In native routing mode (`routingMode=native`): * Cilium v1.14 versions before v1.14.8 * Cilium v1.15 versions before v1.15.2 * In tunneling mode (`routingMode=tunnel`): * Cilium v1.14 versions before v1.14.4 * Cilium v1.14.4 if `encryption.wireguard.encapsulate` is set to `false` (default).

This issue has been resolved in:

* In native routing mode (`routingMode=native`): * Cilium v1.14.8 * Cilium v1.15.2 * In tunneling mode (`routingMode=tunnel`): * Cilium v1.14.4. **NOTE** `encryption.wireguard.encapsulate` must be set to `true`. ### Workarounds

There is no workaround to this issue.

### Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @brb, @giorio94, @gandro and @jschwinger233 for their work on triaging and remediating this issue.

### For more information If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

If you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities…

 https://cve.radiocsirt.org/vuln/gsd-2024-28250 gsd-2024-28250 2026-10-04T06:18:12.923724+00:00 gsd-2024-28250