Auth bypass in Cilium Tetragon
CVE-2026-65960
Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node hostNetwork pods can reach the listener and invoke privileged methods without authentication. These methods can add, delete, or reconfigure tracing policies and change debug settings, potentially resulting in privilege escalation or container escape. Version 1.7.0 changes the default endpoint to a Unix-domain socket. Deployments that do not expose an unauthenticated TCP listener are not affected.
Vulnerability class: Broken Authentication
Published .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Cilium Tetragon — versions < 1.7.0
Weakness classification (CWE)
References
- https://github.com/cilium/tetragon/commit/8e89933d3526f37c04f7523013ff32f8b1c6f62a
- https://github.com/cilium/tetragon/commit/fe46101770b960ebbf39fe9749bb20d49cf178b2
- https://github.com/cilium/tetragon/pull/4882
- https://github.com/cilium/tetragon/releases/tag/v1.7.0
- https://github.com/cilium/tetragon/security/advisories/GHSA-6qqg-3qf7-p3v5
Frequently asked questions
- What is CVE-2026-65960?
- CVE-2026-65960 is a high-severity vulnerability in Cilium Tetragon, classified under Missing Authentication for Critical Function. CVSS score: 8.8/10. Published 2026-11-06.
- How severe is CVE-2026-65960?
- High severity. CVSS v3 base score is 8.8 out of 10.