CVE-2026-49445CWE-732

Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Critical · published July 15, 2026

CVSS v3.1
9.2
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

The record
Technical detail
CVSS v3.1
9.2 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-07-15T19:11Z
EPSS history
Timeline
  • 15 JUL 19:11Z
    Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
    cvelistv5