CVE-2026-41520: Cillium exposes sensitive information included in the cilium-bugtool debug archive
Analyzed
AliasesCGA-2f6x-hgc2-jc5wCGA-68x7-6v6h-p447CGA-f2h6-55jm-7pg6CGA-g89p-853r-w6p2CGA-gj4c-q2q3-hjm3CGA-p3m6-qh5x-h32vGHSA-gj49-89wh-h4gjBIT-cilium-2026-41520BIT-cilium-operator-2026-41520BIT-hubble-relay-2026-41520GO-2026-5400CGA-3738-8fc6-jw73CGA-3jw5-fv83-4xcmCGA-42jw-mv2r-35x8CGA-4g4x-f72m-xmv4CGA-4g5c-fqvj-89f3CGA-4vp6-h4wq-5vgwCGA-59wm-44rc-683vCGA-5f24-6557-3525CGA-5hq4-2386-6p89CGA-5hw5-87ch-vx29CGA-6475-x5wp-x6rqCGA-64x5-868g-43g6CGA-6chj-mpmp-9xq4CGA-6hcq-9m35-qwxqCGA-6vhx-c89h-975mCGA-72gq-874g-jwh7CGA-73w9-h93j-6c7pCGA-74pm-xcgq-r779CGA-7vx5-mmqm-rm7qCGA-8jpf-4jgj-h3xvCGA-8vhc-mmmf-pc2vCGA-99v2-q39w-cg74CGA-9qv4-83h9-2mf5CGA-9rj4-6q47-2qr9CGA-9x73-42fv-42fjCGA-ccwx-ppqh-v67qCGA-cmpf-p85r-4vqgCGA-cw6m-8qmw-wjhjCGA-fj69-h937-vvf9CGA-fjpx-w8r7-r475CGA-fww5-r8w4-8fr8CGA-g35f-rvjm-frh2CGA-g3q4-j2jx-mrphCGA-g876-m29c-hqfhCGA-gh6h-qx3x-2f9xCGA-h435-5cpm-3wp2CGA-h4g2-ccj4-hqj2CGA-h6x2-h2vh-9vcpCGA-hjvh-r5xw-p27vCGA-m3c7-p37j-vw5xCGA-p3mj-w333-8p9pCGA-p53p-7c2w-2chrCGA-p5xp-x674-rhh5CGA-pjmx-fhfj-32c3CGA-q349-fq64-f3pcCGA-q3cf-xm6w-wwmgCGA-q648-5wq7-r3w8CGA-qhph-xw8c-xv2hCGA-qj9g-6rxw-3699CGA-qv2q-fvpf-fw8fCGA-r6rq-g5m4-m66pCGA-rc4w-923h-cw93CGA-v7ww-ghjm-xr8xCGA-vjrx-3xpf-5pghCGA-vx8q-86hx-2g2vCGA-vxfh-v65p-3g9jCGA-w3fm-5f8w-xr7gCGA-w64r-59v6-v6pxCGA-w8fh-66vr-p7f2CGA-wp5f-34f5-g5g3CGA-wq8r-vw9r-6v58CGA-x3wh-pmfv-fm6gCGA-x9pv-rr7h-9734CGA-xfhj-8hq6-6jr7CGA-xfxv-96m8-mc4vCGA-xqgh-j9j6-4h4f
Published 08-05-2026Last modified 13-05-2026
Vulnerability summary
CVE-2026-41520 is a high (CVSS 7.9) vulnerability in cilium. EPSS estimates a 0.08% chance of exploitation in the next 30 days, higher than 0.2% of scored vulnerabilities.
CVSS score
7.9/10
010
High · v3.1 (CVE.org)EPSS score
0.08%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 13-05-2026Last modifiedVulnerability information updated.
Description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:NSources5 sources · 4.4–7.9
- OSV · WolfiEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- OSV · GoEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.08%
Chance of exploitation in the next 30 days
Percentile
0%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.08% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected systems
Chainguard22 products
- cilium-1.16All versions (No fix recorded)
- cilium-1.16-clustermesh-apiserverAll versions (No fix recorded)
- cilium-1.16-hubble-relayAll versions (No fix recorded)
- cilium-1.16-operator-awsAll versions (No fix recorded)
- cilium-1.16-operator-genericAll versions (No fix recorded)
Wolfi3 products
- hubble-ui-backend< 0.13.5-r1
- kubescape< 4.0.5-r3
- kubescape-operator< 0.2.140-r1
Cilium1 product
- cilium< 1.17.15 | ≥ 1.18.0, < 1.18.9 | ≥ 1.19.0, < 1.19.3
Github.com/cilium1 product
- cilium< 1.17.15 | ≥ 1.18.0, < 1.18.9 | ≥ 1.19.0, < 1.19.3
4 vendors · 27 products
References
8 links- github.com/cilium/cilium/security/advisories/GHSA-gj49-89wh-h4gjX Refsource CONFIRMAdvisoryWEBMitigationVendor Advisory
- github.com/cilium/ciliumPACKAGE