cilium vulnerabilities

Products

• cilium 39
• ebpf 1
• github.com/cilium/cilium-cli 1
• github.com/cilium/ciliumCilium 1
• github.com/cilium/hubble 1
• tetragon 1

Latest cilium CVEs

Newest publication first · page 1 of 2

1. CVE-2026-65960 Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods

   Published 2026-11-06

   High·CVSS 8.8 EPSS 0.14%

   Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node...

2. CVE-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

   Published 2026-07-15

   Medium·CVSS 5.4 EPSS 0.25%

   Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured w...

3. CVE-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

   Published 2026-07-15

   High·CVSS 8.9 EPSS 0.18%

   Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the Refe...

4. CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

   Published 2026-07-15

   High·CVSS 8.8 EPSS 0.17%

   Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy...

5. CVE-2026-53935 CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

   Published 2026-07-07

   Medium·CVSS 6.9 EPSS 0.34%

   Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Servic...

6. CVE-2026-10722 cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

   Published 2026-06-03

   Medium·CVSS 4.8 EPSS 0.18%

   A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be pe...

7. CVE-2026-41520 Cillium exposes sensitive information included in the cilium-bugtool debug archive

   Published 2026-05-08

   Medium·CVSS 4.4 EPSS 0.08%

   Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. Thi...

8. CVE-2026-33726 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

   Published 2026-03-27

   Medium·CVSS 4.3 EPSS 0.26%

   Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-...

9. CVE-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

   Published 2026-02-19

   Medium·CVSS 5.4 EPSS 0.14%

   Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version...

10. CVE-2025-64715 Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

    Published 2025-11-29

    Medium·CVSS 5.5 EPSS 0.18%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attache...

11. CVE-2025-48056 Hubble CLI vulnerable to character injection

    Published 2025-05-20

    Medium·CVSS 5.3 EPSS 0.29%

    Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulatio...

12. CVE-2025-32793 Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

    Published 2025-04-21

    Medium·CVSS 4.0 EPSS 0.14%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating...

13. CVE-2025-30163 Node based network policies may incorrectly allow workload traffic

    Published 2025-03-24

    Medium·CVSS 4.7 EPSS 0.21%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (fromNodes and toNodes) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in fromNodes and toNodes sections of network p...

14. CVE-2025-30162 East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

    Published 2025-03-24

    Medium·CVSS 4.3 EPSS 0.22%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a...

15. CVE-2025-23047 Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

    Published 2025-01-22

    Medium·CVSS 6.5 EPSS 0.49%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 thr...

16. CVE-2025-23028 DoS in Cilium agent DNS proxy from crafted DNS responses

    Published 2025-01-22

    Medium·CVSS 5.3 EPSS 0.45%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS...

17. CVE-2024-52529 Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

    Published 2024-11-25

    Medium·CVSS 5.8 EPSS 0.52%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the firs...

18. CVE-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present

    Published 2024-10-21

    High·CVSS 8.7 EPSS 0.40%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more nar...

19. CVE-2024-42486 Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API

    Published 2024-08-16

    High·CVSS 7.2 EPSS 0.57%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could le...

20. CVE-2024-42488 Cilium agent's race condition may lead to policy bypass for Host Firewall policy

    Published 2024-08-15

    Medium·CVSS 6.8 EPSS 0.50%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideN...

21. CVE-2024-42487 Cilium's Gateway API route matching order contradicts specification

    Published 2024-08-15

    Medium·CVSS 4.3 EPSS 0.53%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification....

22. CVE-2024-37307 Cilium leaks sensitive information in cilium-bugtool

    Published 2024-06-13

    Medium·CVSS 6.5 EPSS 0.18%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, and 1.15.6, the output of cilium-bugtool can contain sensitive data when the tool is run (with the --envoy-dump flag set) a...

23. CVE-2024-28860 Insecure IPsec transport encryption in Cilium

    Published 2024-03-27

    Medium·CVSS 6.8 EPSS 0.17%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen...

24. CVE-2024-28250 Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies

    Published 2024-03-18

    Medium·CVSS 6.1 EPSS 0.17%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent b...

25. CVE-2024-28249 Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies

    Published 2024-03-18

    Medium·CVSS 6.1 EPSS 0.27%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.