CVE WatchJul 16, 2026

CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled,

CVSS

9.2

Critical

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jul 15, 2026 · Last modified: Jul 16, 2026 · CWE-732

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-162026-07-17

Technical description

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-341107.8 HIG

63.4%

——19WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.9d CVE-2017-176778.8 HIG

60.5%

——18BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.9d CVE-2022-262817.5 HIG

56.5%

——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.9d CVE-2023-317487.8 HIG

53.4%

——16Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.9d CVE-2023-390049.8 CRI

52.0%

——16Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.9d CVE-2021-406496.5 MED

51.6%

——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.9d