Security Vulnerability in Tetragon eBPF Project Affecting Cilium

CVE-2026-65960

What is CVE-2026-65960?

The Tetragon eBPF-based security observability and runtime enforcement project exposes a serious vulnerability in versions prior to 1.7.0. The Helm default configuration allows the privileged gRPC API to be accessed through an unauthenticated TCP listener on localhost:54321. This situation enables an attacker who can run or compromise hostNetwork pods on the same node to invoke privileged methods without authentication. Such actions can lead to unauthorized addition, deletion, or reconfiguration of tracing policies and adjusting debug settings, ultimately resulting in potential privilege escalation or container escape. The release of version 1.7.0 rectifies this issue by transitioning the default endpoint to a Unix-domain socket, thereby enhancing security for deployments that do not expose an unauthenticated TCP listener.

References