Affected by GO-2025-4167
and 5 other vulnerabilities
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
GO-2026-4522: Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium
GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium
GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
DaemonInitialization can be used to depend on the legacy daemon initialization.
This will make sure the Hive start hook of the "Daemon cell" runs before the start
hook of any dependent cell. In detail, `newDaemon` has been called, but `startDaemon`
is likely going to run in parallel with the start hook of the dependent cell.
Affected by 
Documentation
¶
Source Files