CVE-2026-41520

What it actually does

Affected Cilium versions can cause the cilium-bugtool diagnostic collection output to include sensitive data when WireGuard encryption is enabled. The issue is an information disclosure in generated troubleshooting artifacts rather than a network-reachable service flaw: an attacker generally needs high local privileges to run the tool, or access to previously generated bugtool bundles through support systems, artifact stores, file shares, backups, CI logs, or incident response collections. Exposed data may include WireGuard-related encryption material or configuration data that can undermine the confidentiality and integrity assumptions of encrypted Cilium traffic.

Why it matters to the business

Organizations using Cilium with WireGuard encryption may have unintentionally stored or shared sensitive cluster networking data in diagnostic bundles. If those bundles were uploaded to tickets, vendor support portals, collaboration tools, object storage, or retained in backups, the exposure can persist even after patching. A compromise of these artifacts could increase the risk of encrypted cluster traffic being inspected, impersonated, or tampered with, and may require key rotation and artifact cleanup. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has very low EPSS probability, and has no reported exploit maturity, but it has been public for 96 days and should be remediated anywhere Cilium WireGuard is enabled.

How an attack unfolds

An attacker first obtains high-privilege local access to a Cilium node, container, administrative workstation, or artifact repository that contains Cilium diagnostic output. They then either run cilium-bugtool against a vulnerable Cilium deployment with WireGuard encryption enabled or locate previously generated bugtool bundles. The attacker inspects the collected output for WireGuard-sensitive data, Cilium configuration, node identity details, or other secrets included in the diagnostic archive. If usable encryption material or sensitive configuration is present, the attacker can use it to weaken the confidentiality of encrypted Cilium communications, support lateral movement planning, impersonate trusted components where applicable, or improve future attacks against the cluster networking layer.

How to fix it

Upgrade Cilium to a patched release: 1.17.15, 1.18.9, 1.19.3, or later in the applicable release line. Treat existing cilium-bugtool outputs generated from vulnerable versions with WireGuard enabled as sensitive until reviewed. Remove unnecessary diagnostic bundles from local disks, ticket attachments, chat systems, support portals, object stores, CI/CD artifacts, and backups where feasible. Restrict who can run cilium-bugtool and who can access diagnostic bundles. If any affected bugtool output was exposed outside trusted administrators, rotate WireGuard-related keys or perform the Cilium-supported equivalent key/material refresh and redeploy affected components as appropriate. Apply least-privilege access controls, short retention periods, and encryption-at-rest for troubleshooting artifacts.

How to confirm the fix worked

Confirm the deployed Cilium version is 1.17.15, 1.18.9, 1.19.3, or later. Verify whether WireGuard encryption is enabled in Cilium configuration. Generate a new diagnostic bundle from a patched non-production environment and inspect it to confirm sensitive WireGuard material is not present. Inventory existing bugtool bundles and confirm they were created only by patched versions or were securely removed, access-controlled, or reviewed and sanitized. Validate that only approved administrators can execute cilium-bugtool or retrieve its output. Where prior exposure is suspected, confirm completion of key rotation and ensure old bundles are no longer accessible from shared repositories or support channels.

Typical attack path

1. Identify an organization or environment using Cilium with WireGuard encryption enabled.
2. Gain high-privilege local access to a Cilium node, administrative host, support artifact repository, file share, backup, CI/CD artifact store, or ticketing system containing diagnostics.
3. Run cilium-bugtool on an affected Cilium version or retrieve an existing bugtool output bundle.
4. Extract and inspect the diagnostic output for WireGuard keys, encryption state, Cilium configuration, node details, endpoint data, or other sensitive artifacts.
5. Use the exposed data to undermine encrypted traffic protections, assist impersonation or lateral movement, or plan follow-on attacks against the Kubernetes/Cilium environment.

How to detect it

Look for evidence that cilium-bugtool was executed on vulnerable Cilium deployments with WireGuard encryption enabled, and identify whether the resulting archives were accessed or shared. Useful sources include EDR process telemetry, Linux auditd logs, shell history, sudo logs, Kubernetes audit logs for exec sessions into Cilium pods, container runtime logs, node filesystem metadata, ticketing and support portal attachment logs, object storage access logs, CI/CD artifact logs, file share audit logs, and backup indexes. Search for cilium-bugtool executions, diagnostic archive creation, archive uploads, and archive downloads by unexpected users or from unusual locations. Inspect historical bugtool bundles for WireGuard-related private key material, interface configuration, encryption state, and Cilium agent configuration. If exposed archives were accessed by untrusted accounts, treat the event as a secret disclosure and investigate for subsequent suspicious network, Kubernetes, or administrative activity.

• cilium-bugtool
• cilium bugtool
• cilium_wg0
• WireGuard
• wireguard
• enable-wireguard
• encryption.type=wireguard
• --enable-wireguard
• cilium-bugtool-
• bugtool
• wg show
• private key
• PrivateKey
• public key
• ListenPort

What your security team should do

• Prioritize upgrades for all Cilium deployments using WireGuard encryption to 1.17.15, 1.18.9, 1.19.3, or later.
• Immediately inventory and access-review all historical cilium-bugtool diagnostic bundles generated from Cilium versions earlier than the fixed releases.
• Treat vulnerable diagnostic bundles as secrets: restrict access, remove unnecessary copies, and sanitize or destroy retained artifacts where operationally safe.
• If vulnerable bugtool output was shared externally or stored in broadly accessible locations, rotate affected WireGuard-related keys or perform the Cilium-supported key refresh process.
• Add monitoring for execution of cilium-bugtool and creation, upload, or download of Cilium diagnostic archives.
• Update support and incident response procedures so Cilium diagnostic bundles are classified as sensitive and reviewed before sharing.
• Because EPSS is very low and there is no KEV listing, prioritize based on actual WireGuard usage and diagnostic artifact exposure rather than internet exposure alone.