1sealsemantic last-mile verification

Research / Finding

Add a warning when TLS isn't enabled for Hubble Relay

F-CILIUM-001-002

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Read the evidence · View in research browse

Recorded evidence

—score not recorded
cilium/cilium #44772Security PRcilium/cilium

Add a warning when TLS isn't enabled for Hubble Relay

merged to main/pre-release only
details
Finding IDs
F-CILIUM-001-002
Status
merged to main/pre-release only
Recorded credit
Reported by @1seal
Reported date
Rationale
warns that Hubble Relay without TLS exposes sensitive observability data to any reachable in-cluster client outside the intended trust boundary. public PR #44772 merged on 2026-04-22 and is present in main / v1.20.0-pre.* only; not fixed for stable users in v1.19.5, v1.18.11, or v1.17.17.
PR opened by
@ferozsalam
PR state observed
closed; GitHub merged: true; 2026-09-24
PR observation basis
Public PR metadata recorded in the 2026-09-24 evidence audit; not a live status feed.
Contribution boundary
Report-associated upstream work; @1seal code authorship is not claimed. Credit, where recorded, is a separate fact.

F-CILIUM-001-002: Secret handling. The contribution warns about unprotected Relay transport; it does not enable TLS by default. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-CILIUM-001-002

Security area (1seal assessment): Confidentiality. The change warns about unencrypted Hubble Relay/UI traffic; it does not itself enable TLS. Reviewed 21 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.