Detections
Analytics

SCA: security update for github.com/cilium/cilium (GHSA-hxv8-4j4r-cqgv)

medium Tenable Cloud Security Plugin ID 439272

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to
 versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to
 L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and
 BPF Host Routing is disabled. Per-Endpoint Routing is disabled by default, but is automatically enabled in
 deployments using cloud IPAM, including Cilium ENI on EKS (`eni.enabled`), AlibabaCloud ENI
 (`alibabacloud.enabled`), Azure IPAM (`azure.enabled`, but not AKS BYOCNI), and some GKE deployments
 (`gke.enabled`; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically
 not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS
 with Cilium ENI mode is likely the most common affected environment. Versions 1.17.14, 1.18.8, and 1.19.2
 contain a patch. There is currently no officially verified or comprehensive workaround for this issue. The
 only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing
 connections, and potential conflicts if running in cloud providers. (CVE-2026-33726)

Solution

Update the github.com/cilium/cilium library and its related packages to version 1.17.14 or later.

See Also

https://github.com/advisories/GHSA-hxv8-4j4r-cqgv

Plugin Details

Severity: Medium

ID: 439272

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/26/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.15

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-33726

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/26/2026

Vulnerability Publication Date: 3/26/2026

Reference Information

CVE: CVE-2026-33726