Listen to this Post
CVE-2026-56743 is a medium-severity vulnerability in Cilium, a networking and security solution for Kubernetes. The flaw affects Cilium versions 1.19.0 through 1.19.4. It arises when the system processes standard Kubernetes `NetworkPolicy` specifications that use CIDR-based `ipBlock` rules but lack explicit pod or namespace selectors. Under a specific condition—when Cilium is deployed with a custom `clusterName` value rather than the default "any"—the policy parser makes an incorrect assumption.
Specifically, the parser erroneously instantiates a pod selector on these “selectorless” peer definitions. This procedural error causes Cilium to append an unintended wildcard namespace label selector to the policy’s allowed Layer 3 rules. The consequence is that the network policy allows ingress traffic from other workloads running in the same namespace as the subject of the policy, effectively bypassing the intended isolation. This happens despite the policy author only intending to allow traffic from a specific IP block.
For example, a policy designed to only allow ingress from the IP `192.0.2.3` to a `test-server` pod in the `default` namespace would, in affected versions, also permit traffic from any other pod in the `default` namespace. This can lead to unauthorized access and lateral movement between pods. The issue was patched in Cilium version 1.19.5. As a workaround, developers can use `CiliumNetworkPolicy` or CiliumClusterwideNetworkPolicy, which are not affected by this bug. The vulnerability was discovered and reported by a user identified as @TheBeeZee.
DailyCVE Form:
Platform: Kubernetes/Cilium
Version: 1.19.0-1.19.4
Vulnerability: Auth Bypass
Severity: Medium (CVSS 5.4)
Date: 2026-07-15
Prediction: Already Patched (2026-07-15)
What Undercode Say:
To verify if your cluster is affected, you can check the Cilium version and the `clusterName` configuration.
Check Cilium agent version
kubectl get pods -n kube-system -l k8s-app=cilium -o jsonpath='{.items[bash].spec.containers[bash].image}'
Check the clusterName configuration in the Cilium ConfigMap
kubectl get configmap -n kube-system cilium-config -o jsonpath='{.data.cluster-name}'
Exploit: (Educational Purposes!)
An attacker could exploit this by creating a pod in the same namespace as a vulnerable policy’s target. Even if a `NetworkPolicy` is intended to only allow traffic from a specific IP, the misconfiguration would allow the attacker’s pod to communicate with the target.
1. Identify a Target: Find a pod protected by a `NetworkPolicy` that uses an `ipBlock` rule without `podSelector` or namespaceSelector.
2. Deploy a Malicious Pod: Create a new pod in the same namespace.
3. Initiate Connection: From the malicious pod, attempt to connect to the target pod’s service or IP.
4. Bypass Policy: Due to the vulnerability, the connection will be allowed, successfully bypassing the intended network policy.
Protection:
Upgrade: Immediately upgrade Cilium to version `v1.19.5` or later.
Workaround: Replace the affected standard `NetworkPolicy` with an equivalent `CiliumNetworkPolicy` or CiliumClusterwideNetworkPolicy, which are not vulnerable to this issue.
Audit: Review all existing `NetworkPolicy` resources that use `ipBlock` rules without selectors and assess if they are at risk.
Monitor: Implement monitoring to detect unusual traffic patterns within namespaces that could indicate an attempted exploit.
Impact:
Successful exploitation allows an attacker to bypass network isolation policies, enabling unauthorized communication between pods within the same namespace. This undermines the principle of least privilege and can facilitate lateral movement, data exfiltration, or further attacks within the cluster.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
