CVE-2026-26963

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-269642.7Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow CVE-2026-269658.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_CVE-2026-269675.3PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Bu CVE-2026-26978.8An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parame CVE-2026-269726.7OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized outp CVE-2026-269734.3Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Re CVE-2026-269749.8Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,CVE-2026-269758.8Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below CVE-2026-269775.3Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unautho CVE-2026-269788.6FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore ope CVE-2026-269792.7Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive a CVE-2026-26986.5An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.