Medium
golang-github-cilium-ebpf — security advisory
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
- Products
- golang-github-cilium-ebpf
- Affected versions
- 0.11.0-1, 0.11.0-2, 0.17.3+ds1-4, 0.2.0-1, 0.21.0+ds1-1, 0.21.0+ds1-2, 0.22.0+ds1-1, 0.6.2-2, 0.7.0-1, 0.9.1-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-26963
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:42 UTC · Revision 1
Source evidence
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
osv:UBUNTU-CVE-2026-26963
golang-github-cilium-ebpf
Fixed versions: Not specified
golang-github-cilium-ebpf
Fixed versions: Not specified
golang-github-cilium-ebpf
Fixed versions: Not specified
golang-github-cilium-ebpf
Fixed versions: Not specified
golang-github-cilium-ebpf
Fixed versions: Not specified
Complete source record
{
"id": "c125e9b42561e6610d1a79faafdb89020f0567fd02d2e127d39d4afda17383d2",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-26963",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-26963",
"summary": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.",
"evidence": "osv:UBUNTU-CVE-2026-26963",
"products": [
{
"name": {
"value": "golang-github-cilium-ebpf",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.2.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.6.2-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.7.0-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "golang-github-cilium-ebpf",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.11.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.11.0-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "golang-github-cilium-ebpf",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.11.0-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "golang-github-cilium-ebpf",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.17.3+ds1-4",
"evidence": "/affected/3/versions"
},
{
"value": "0.21.0+ds1-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.21.0+ds1-2",
"evidence": "/affected/3/versions"
},
{
"value": "0.22.0+ds1-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "golang-github-cilium-ebpf",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.11.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "0.17.3+ds1-4",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-26963",
"aliases": [
"UBUNTU-CVE-2026-26963"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-cilium-ebpf",
"purl": "pkg:deb/ubuntu/golang-github-cilium-ebpf?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.2.0-1",
"0.6.2-2",
"0.7.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26963.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-cilium-ebpf-dev",
"binary_version": "0.7.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-cilium-ebpf",
"purl": "pkg:deb/ubuntu/golang-github-cilium-ebpf?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.9.1-1",
"0.11.0-1",
"0.11.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26963.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-cilium-ebpf-dev",
"binary_version": "0.11.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-cilium-ebpf",
"purl": "pkg:deb/ubuntu/golang-github-cilium-ebpf?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.11.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26963.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-cilium-ebpf-dev",
"binary_version": "0.11.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-cilium-ebpf",
"purl": "pkg:deb/ubuntu/golang-github-cilium-ebpf?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.17.3+ds1-4",
"0.21.0+ds1-1",
"0.21.0+ds1-2",
"0.22.0+ds1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26963.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-cilium-ebpf-dev",
"binary_version": "0.22.0+ds1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-github-cilium-ebpf",
"purl": "pkg:deb/ubuntu/golang-github-cilium-ebpf?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.11.0-2",
"0.17.3+ds1-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26963.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-cilium-ebpf-dev",
"binary_version": "0.17.3+ds1-4"
}
]
}
}
],
"modified": "2026-10-17T12:58:48.204697761Z",
"provider": "osv",
"upstream": [
"CVE-2026-26963"
],
"references": [
"https://ubuntu.com/security/CVE-2026-26963",
"https://www.cve.org/CVERecord?id=CVE-2026-26963",
"https://github.com/cilium/cilium/commit/88e28e1e62c0b1a02c3f0fc22d888ac9eefbe885",
"https://github.com/cilium/cilium/pull/42892",
"https://github.com/cilium/cilium/releases/tag/v1.18.6",
"https://github.com/cilium/cilium/security/advisories/GHSA-5r23-prx4-mqg3"
]
},
"related_cves": [
{
"value": "CVE-2026-26963",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359065,
"published_at": "2026-02-20T00:16:00+00:00"
}