CVE-2026-56742: Missing ReferenceGrant Authorization Check in Cilium Gateway API Request Mirroring

Cilium is an open-source, cloud-native networking, observability, and security solution designed for Kubernetes environments. It utilizes eBPF technology to provide high-performance container networking, service mesh functionality, and security enforcement at the data plane layer. Within Cilium, the Kubernetes Gateway API is implemented to manage ingress and service routing, utilizing Envoy as the underlying proxy to execute complex traffic routing policies.

In Kubernetes environments implementing the Gateway API, resource access across namespaces is strictly governed by security specifications. The ReferenceGrant resource defines explicit boundaries, allowing services in one namespace to safely reference backends or routes in another namespace. When these boundaries are not enforced, tenant isolation fails, exposing internal services to unauthorized routing configurations from other namespaces.

This vulnerability, tracked as CVE-2026-56742, constitutes a missing authorization check within the Cilium Operator's route translation engine. Under specific configurations, namespaced users can configure traffic mirroring filters to redirect data streams to unauthorized services. By default, the Gateway API functionality is disabled in Cilium, which mitigates the immediate exposure of unconfigured clusters.

The root cause of CVE-2026-56742 lies in the logical separation of validation steps within the Cilium Operator's translation pipeline. When parsing standard backend routing targets (spec.rules[].backendRefs), the operator calls validation routines to verify namespace permissions. This validation leverages the ReferenceGrant API to confirm whether the target namespace permits references from the source route's namespace.

However, a discrepancy was introduced in the handling of traffic mirroring filters, specifically HTTPRouteFilterRequestMirror and GRPCRouteFilterRequestMirror. During translation of these filters, the operator extracted the backend reference of the mirror target and directly resolved the corresponding Kubernetes Service object. It performed this resolution without subjecting the mirror's target reference to the IsBackendReferenceAllowed validation function.

This flaw allows a namespaced user to bypass standard cross-namespace authorization mechanisms entirely. Because the Envoy control plane configuration is compiled directly from these parsed models, Cilium instructs the Envoy proxy to duplicate and forward live request traffic to the unauthorized target. This architecture creates an undocumented and unauthorized pathway for data transmission across administrative boundaries.

An analysis of the vulnerable and patched source code in operator/pkg/model/ingestion/gateway.go demonstrates how the omission was addressed. In the unpatched version, the operator processed the RequestMirror filters without verifying permissions. The translation code simply resolved the service specification and appended the mirror configuration directly to the compiled route model.

// Unpatched logic in operator/pkg/model/ingestion/gateway.go
case gatewayv1.HTTPRouteFilterRequestMirror:
    svc := getServiceSpec(string(f.RequestMirror.BackendRef.Name), helpers.NamespaceDerefOr(f.RequestMirror.BackendRef.Namespace, hr.Namespace), services)
    if svc != nil {
        requestMirrors = append(requestMirrors, toHTTPRequestMirror(*svc, f.RequestMirror, hr.Namespace))
    }

The security patch inserts a validation step before retrieving the target service spec. It first ensures the RequestMirror filter structure itself is not null to prevent nil-pointer panics. It then calls helpers.IsBackendReferenceAllowed, passing the source namespace, the backend reference, the routing scheme group, and the collection of active grants.

// Patched logic in operator/pkg/model/ingestion/gateway.go
case gatewayv1.HTTPRouteFilterRequestMirror:
    if f.RequestMirror == nil {
        continue
    }
 
    if !helpers.IsBackendReferenceAllowed(hr.GetNamespace(),
        gatewayv1.BackendRef{BackendObjectReference: f.RequestMirror.BackendRef},
        gatewayv1.SchemeGroupVersion.WithKind("HTTPRoute"), grants) {
        continue
    }
 
    svc := getServiceSpec(string(f.RequestMirror.BackendRef.Name), helpers.NamespaceDerefOr(f.RequestMirror.BackendRef.Namespace, hr.Namespace), services)
    if svc != nil {
        requestMirrors = append(requestMirrors, toHTTPRequestMirror(*svc, f.RequestMirror, hr.Namespace))
    }

This remediation ensures that if the reference is not explicitly permitted by an active ReferenceGrant resource in the destination namespace, the loop skips the mirror filter. A parallel fix was applied to the extractGRPCRoutes function to secure GRPCRoute instances, ensuring complete coverage across both protocols.

Exploitation of this vulnerability requires the attacker to have Kubernetes Role-Based Access Control (RBAC) permissions to create or modify HTTPRoute or GRPCRoute resources in at least one namespace. No cluster-wide administrative privileges are required, making this an effective vector for privilege escalation and lateral movement in multi-tenant environments. The attacker must target a cluster where the Cilium Gateway API is enabled.

To execute the attack, the attacker deploys a route containing a RequestMirror filter targeting a sensitive service in a different namespace, such as secure-service in tenant-b. Normally, this configuration would be rejected during control-plane validation due to the absence of an authorizing ReferenceGrant. Under the vulnerable version of Cilium, the operator compiles this configuration into Envoy directives without warning.

Once the route is applied, any legitimate traffic sent to the attacker's ingress route is duplicated at the proxy layer. The duplicate request, containing all original HTTP headers, cookies, and payloads, is forwarded to the target service. This enables the attacker to trigger unintended actions or interact with backends residing inside isolated network zones.

The security impact of CVE-2026-56742 is classified as a multi-tenancy logical security bypass. In a Kubernetes cluster configured for multiple distinct tenants, namespace isolation is the primary barrier preventing cross-tenant data exposure. By subverting the ReferenceGrant enforcement, this vulnerability breaks the logical isolation layer, enabling cross-boundary data routing.

An attacker who successfully exploits this flaw can exfiltrate sensitive data by mirroring request streams. If the mirrored requests contain authorization headers, session cookies, or proprietary payloads, those secrets are transmitted directly to the unauthorized destination. This could lead to a secondary compromise of services running within the target namespace.

According to the National Vulnerability Database (NVD), the CVSS v3.1 score is evaluated at 5.9 (Medium) with a vector of CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. The rating reflects that while the attack complexity is low and no user interaction is required, it requires high privileges (namespaced route creation) and is limited to adjacent network topologies. However, in shared environments, the impact on integrity and confidentiality can be significant.

Remediation requires upgrading the Cilium container images to a version containing the official patches. The fix has been backported to all active release branches. Administrators should deploy the updated operators and agents according to their standard upgrade procedures.

For deployments where an immediate upgrade is not feasible, several temporary mitigation strategies can be applied. First, restrict RBAC permissions for HTTPRoute and GRPCRoute resources across the cluster. Ensure that only fully trusted service accounts and administrators have creation or modification privileges for these custom resources.

Additionally, audit active routing configurations to detect unauthorized cross-namespace references. Cluster administrators can execute queries to list routes containing mirror filters that reference foreign namespaces. If any unauthorized configurations are found, the offending route resources should be deleted immediately to prevent continued traffic redirection.