https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:45:07.885618+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-cilium-2026-56743 BIT-cilium-2026-56743 — Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured wi… 2026-10-07T00:45:07.936152+00:00

Affected: Bitnami: cilium

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

 https://cve.radiocsirt.org/vuln/euvd-2026-338218 EUVD-2026-338218 2026-10-07T00:45:07.936215+00:00 EUVD-2026-338218 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56743 fkie_cve-2026-56743 2026-10-07T00:45:07.936232+00:00

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.

 https://cve.radiocsirt.org/vuln/ghsa-fm8w-2m5w-9j7r GHSA-fm8w-2m5w-9j7r — Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured wi… 2026-10-07T00:45:07.936258+00:00

Affected: Go: github.com/cilium/cilium

### Impact

Standard Kubernetes `NetworkPolicy` specifications using CIDR-based `ipBlock` rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.

When Cilium deployment is configured with a specific custom `clusterName` (rather than the default `"any"` value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.

Example policy affected by this issue: ``` apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-server namespace: default spec: podSelector: matchLabels: app: test-server policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 192.0.2.3 ```

In affected versions, this policy erroneously allows the `test-server` Pod in the `default` namespace to receive any traffic from other workloads running in the `default` namespace.

### Patches

This issue has been patched in:

- Cilium v1.19.5

Releases below v1.19.0 are not affected.

### This issue affects:

- Cilium v1.19 between v1.19.0 and v1.19.4 inclusive

### Workarounds

Developers can create the equivalent policy using CiliumNetworkPolicy [fromCIDR expressions](https://docs.cilium.io/en/stable/security/policy/layer3/#ip-cidr-based). CiliumNetwo…