Authorization bypass in Cilium Gateway API HTTPRoute traffic mirroring (CVE-2026-56742)

In Cilium clusters with Gateway API enabled, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. This allows unauthorized cross-namespace traffic mirroring by users with HTTPRoute creation or update privileges. Gateway API functionality is disabled by default. Affected versions: - < 1.17.17 - >= 1.18.0, < 1.18.11 - >= 1.19.0, < 1.19.5 We recommend updating to: 1.17.17, 1.18.11, 1.19.5. CVSS 8.9 · our assessment: this_week Vendor advisory: https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj Details: https://vuln.today/cve/CVE-2026-56742