CVE-2026-41520CWE-200CWE-312

Cillium exposes sensitive information included in the cilium-bugtool debug archive

High · published May 8, 2026

CVSS v3.1
7.9
EPSS
0%
Percentile
0.2
In the wild
Unconfirmed
What it is

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00084 · 0.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-05-08T22:01Z
EPSS history
Timeline
  • 08 MAY 22:01Z
    Cillium exposes sensitive information included in the cilium-bugtool debug archive
    cvelistv5