6.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53935

CVE-2026-53935: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53935

CVE-2026-53935:

6.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cilium/cilium	go	>= 1.19.0, < 1.19.4	1.19.4
github.com/cilium/cilium	go	>= 1.18.2, < 1.18.10	1.18.10
github.com/cilium/cilium	go	< 1.17.16	1.17.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Cilium, identified as GHSA-q6h5-q3q6-f87x, allows for cross-namespace service traffic hijacking and can lead to service translation failure. This is due to improper handling of CiliumLocalRedirectPolicy with addressMatcher.

The analysis of the patches reveals two main vulnerable functions depending on the Cilium version:

For versions < 1.17.16 (patched in PR #45412): The vulnerable function is Manager.upsertService located in pkg/redirectpolicy/manager.go. This function did not perform any checks to see if a service already existed at the frontend address specified by a CiliumLocalRedirectPolicy. This allowed a policy to override an existing service, leading to traffic hijacking. The fix introduced a new function, UpsertServiceWithCheck, which verifies the ownership of the frontend before allowing an update, unless a compatibility flag is enabled.
For versions 1.18.2 to 1.18.9 and 1.19.0 to 1.19.3 (patched in PRs #45585 and #45584): The vulnerable function is lrpController.updateRedirects in pkg/loadbalancer/redirectpolicy/controller.go. This function had two flaws. First, it would unconditionally delete a frontend if no backend pods were available for the redirect policy, which could delete an existing service's entry. Second, it did not prevent the policy from overriding an existing service's frontend. The patch adds checks to ensure that the controller only deletes frontends it created and does not override frontends belonging to other services.

The root cause of the vulnerability is the lack of ownership and conflict checks when applying CiliumLocalRedirectPolicy. An attacker with permissions to create these policies could have exploited this to either hijack traffic to sensitive services or cause a denial of service by breaking service translation.

Vulnerable functions

Manager.upsertService

pkg/redirectpolicy/manager.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.