Vulnerability details

CVE-2026-41520

cilium cilium

Cillium exposes sensitive information included in the cilium-bugtool debug archive

CVSS 3.1

7.9High

Official description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.

CVSS scores

Score	Version	Source	Vector
7.9High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
cilium	cilium	< 1.17.15	CVEProject cvelistV5 (CNA)
cilium	cilium	>= 1.18.0, < 1.18.9	CVEProject cvelistV5 (CNA)
cilium	cilium	>= 1.19.0, < 1.19.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/cilium/cilium/security/advisories/GHSA-gj49-89wh-h4gj x_refsource_CONFIRM
https://github.com/cilium/cilium/releases/tag/v1.17.15 x_refsource_MISC
https://github.com/cilium/cilium/releases/tag/v1.18.9 x_refsource_MISC
https://github.com/cilium/cilium/releases/tag/v1.19.3 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-09
Last updated: 2026-05-13
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.07%

Probability of exploitation in 30 days

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-312
Cleartext Storage of Sensitive Information