CVE-2026-56743: Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.

When Cilium deployment is configured with a specific custom clusterName (rather than the default "any" value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy’s allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.

Example policy affected by this issue:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-server
namespace: default
spec:
podSelector:
matchLabels:
app: test-server
policyTypes:
- Ingress
ingress:
- from:
- ipBlock:
cidr: 192.0.2.3

In affected versions, this policy erroneously allows the test-server Pod in the default namespace to receive any traffic from other workloads running in the default namespace.