Networking
Cilium: what changed
In the last 90 days, 13 summarized changes: 3 security advisories, 7 releases, 3 fixes. Stackdiff reads Cilium's own feeds (cilium.io) and writes two sentences per change with a link to the source; it never republishes release notes. Sources last checked .
Needs attention
Breaking changes, security advisories, end-of-life and license changes from the last 90 days, worst first.
1.19.5Securitymedium
GO-2026-6367: Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium
1.19.5Securitymedium
GHSA-fm8w-2m5w-9j7r: Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
1.17.16Securitymedium
GHSA-q6h5-q3q6-f87x: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
Latest changes
Newest first, every type. Releases and fixes sit below anything that can hurt you in the weekly brief; here they are in order.
1.19.5Securitymedium
GO-2026-6367: Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium
1.19.5Securitymedium
GHSA-fm8w-2m5w-9j7r: Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
1.17.16Securitymedium
GHSA-q6h5-q3q6-f87x: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
1.17.15Securitymedium
GHSA-gj49-89wh-h4gj: Cillium exposes sensitive information included in the cilium-bugtool debug archive
1.17.14Securitymedium
GHSA-hxv8-4j4r-cqgv: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
1.16.17Securitymedium
GHSA-38pp-6gcp-rqvm: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
1.15.16Securitymedium
GHSA-5vxx-c285-pcq4: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
1.15.15Securitymedium
GHSA-24qp-4xx8-3jvj: Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
1.14.19Securitymedium
GHSA-h78m-j95m-5356: Cilium has an information leakage via insecure default Hubble UI CORS header
1.14.18Securitymedium
GHSA-9m5p-c77c-f9j7: DoS in Cilium agent DNS proxy from crafted DNS responses
1.16.4Securitymedium
GHSA-xg58-75qf-9r67: Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
1.14.16Securitymedium
GHSA-3wwx-63fv-pfq6: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
1.15.8Securitymedium
GHSA-vwf8-q6fw-4wcm: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API
1.15.8Securitymedium
GHSA-qcm3-7879-xcww: Gateway API route matching order contradicts specification
1.14.14Securitymedium
GHSA-q7w8-72mr-vpgw: Policy bypass for Host Firewall policy due to race condition in Cilium agent
1.13.17Securitymedium
GHSA-wh78-7948-358j: Cilium leaks sensitive information in cilium-bugtool
1.13.14Securitymedium
GHSA-pwqm-x5x6-5586: Cilium has insecure IPsec transport encryption
1.14.8Securitymedium
GHSA-v6q2-4qr3-5cw6: Unencrypted traffic between nodes when using WireGuard and L7 policies
1.13.13Securitymedium
GHSA-j89h-qrvr-xc36: Unencrypted traffic between nodes when using IPsec and L7 policies
Where Stackdiff reads Cilium
- GitHub releases · cilium/cilium
- Hacker News
- OSV advisories · github.com/cilium/cilium
Only what the vendor publishes for machines. Excerpts are capped, summaries are our own two sentences, and every line links back.
Get Cilium changes in your Monday brief
Add Cilium and the rest of your stack; breaking changes and CVEs go out the moment they're seen, everything else on Monday.
Get your first brief →