Is CVE-2026-49445 actively exploited?

No active exploitation of CVE-2026-49445 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49445 be exploited remotely?

No. CVE-2026-49445 requires local access to exploit.

What is the CVSS score of CVE-2026-49445?

CVE-2026-49445 has a CVSS score of 9.2 (CRITICAL).

HOME VULNERABILITIESCVE-2026-49445

CRITICAL

CVE-2026-49445

CWE-732Published: July 15, 2026· Updated: Jul 16, 2026

9.2

CVSS v3.1

EPSS:0.17%probability of exploitation in 30 daysPercentile:6.6th

Official Description

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.

NVD Source

Risk Analysis

This critical vulnerability in Cilium allows a local attacker to access sensitive Envoy admin endpoints, expose TLS secrets, and disrupt cluster traffic. The flaw is due to the creation of a world-accessible admin.sock when L7 functionality is enabled, resulting in a CVSS score of 9.2.

No public exploit is currently known for this vulnerability, which requires local access for exploitation.

Recommended Action

Upgrade Cilium to versions 1.17.14, 1.18.8, or 1.19.2 or later to address this local privilege escalation vulnerability. Ensure proper file permissions and access controls are in place for sensitive files and sockets on cluster nodes.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-49445 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 9.2.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.