CVE-2026-56743: Github.com/cilium/cilium Cilium May Unexpectedly Allow Ingress Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fm8w-2m5w-9j7r",
  "modified" : "2026-09-03T17:17:47Z",
  "published" : "2026-09-03T17:17:47Z",
  "aliases" : [ "CVE-2026-56743" ],
  "summary" : "Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match",
  "details" : "### Impact\n\nStandard Kubernetes `NetworkPolicy` specifications using CIDR-based `ipBlock` rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.\n\nWhen Cilium deployment is configured with a specific custom `clusterName` (rather than the default `\"any\"` value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.\n\nExample policy affected by this issue:\n```\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-server\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: test-server\n  policyTypes:\n  - Ingress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 192.0.2.3\n```\n\nIn affected versions, this policy erroneously allows the `test-server` Pod in the `default` namespace to receive any traffic from other workloads running in the `default` namespace.\n\n### Patches\n\nThis issue has been patched in:\n\n- Cilium v1.19.5\n\nReleases below v1.19.0 are not affected.\n\n### This issue affects:\n\n- Cilium v1.19 between v1.19.0 and v1.19.4 inclusive\n\n### Workarounds\n\nDevelopers can create the equivalent policy using CiliumNetworkPolicy [fromCIDR expressions](https://docs.cilium.io/en/stable/security/policy/layer3/#ip-cidr-based). CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected by this issue.\n\n### Acknowledgements\n\nSpecial thanks to @TheBeeZee for reporting this issue and preparing the fix, and to @fristonio and @odinuge for their assistance in reviewing the solution.\n\n### For more information\n\nIf a vulnerability affecting Cilium appears to have been found, the Cilium security team strongly encourages reporting it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cilium/cilium"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.19.0"
      }, {
        "fixed" : "1.19.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/security/advisories/GHSA-fm8w-2m5w-9j7r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56743"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/pull/46305"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/pull/46456"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/commit/1c84ae3b58a7cd54f7ee355e6c524c82f620eae8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/commit/bacea640404c0805c23515353dc1681c5bf35171"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cilium/cilium"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cilium/cilium/releases/tag/v1.19.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-03T17:17:47Z",
    "nvd_published_at" : "2026-07-15T20:17:51Z"
  }
}