Cilium vulnerable to potential network policy bypass when routing IPv6 traffic
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. This issue only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 and endpoint routes are both disabled by default. The problem has been fixed and is available on versions 1.11.15, 1.12.8, and 1.13.1. As a workaround, disable IPv6 routing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cilium | cilium | before 1.11.15; 1.12.0 to before 1.12.8; 1.13.0 to before 1.13.1 | 1.11.15, 1.12.8, 1.13.1 | Patch available | CNA |
| — | github.com/cilium/cilium (Go) | before 1.11.15 | 1.11.15 | Patch available | GHSA-8fg8-jh2h-f2hc |
| — | github.com/cilium/cilium (Go) | 1.12.0 to before 1.12.8 | 1.12.8 | Patch available | GHSA-8fg8-jh2h-f2hc |
| — | github.com/cilium/cilium (Go) | 1.13.0 to before 1.13.1 | 1.13.1 | Patch available | GHSA-8fg8-jh2h-f2hc |
- cilium Vendorcilium Affected before 1.11.15; 1.12.0 to before 1.12.8; 1.13.0 to before 1.13.1 Fixed in 1.11.15, 1.12.8, 1.13.1 Patch available CNA
- github.com/cilium/cilium (Go) Vendor— Affected before 1.11.15 Fixed in 1.11.15 Patch available GHSA-8fg8-jh2h-f2hc
- github.com/cilium/cilium (Go) Vendor— Affected 1.12.0 to before 1.12.8 Fixed in 1.12.8 Patch available GHSA-8fg8-jh2h-f2hc
- github.com/cilium/cilium (Go) Vendor— Affected 1.13.0 to before 1.13.1 Fixed in 1.13.1 Patch available GHSA-8fg8-jh2h-f2hc
Remediation
- Fix · CNA cilium (cilium) Fixed in 1.11.15, 1.12.8, 1.13.1
- Fix · GHSA-8fg8-jh2h-f2hc github.com/cilium/cilium (Go) Fixed in 1.11.15 Advisory →
- Fix · GHSA-8fg8-jh2h-f2hc github.com/cilium/cilium (Go) Fixed in 1.12.8 Advisory →
- Fix · GHSA-8fg8-jh2h-f2hc github.com/cilium/cilium (Go) Fixed in 1.13.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-27594
- 2026-10-03 Alias added: GHSA-8fg8-jh2h-f2hc
References
Advisory 5
More Cilium vulnerabilities
- TI-2024-32092 CIDR deny policies may not take effect when a more narrow CIDR allow is present CVSS 3.1HIGH 8.7
- TI-2023-12305 Cilium eBPF filters may be temporarily removed during agent restart CVSS 3.1CRITICAL 9.8
- TI-2023-20486 Cilium NetworkPolicy bypass via pod labels CVSS 3.1CRITICAL 9.0
- TI-2022-11721 Incorrect Default Permissions in Cilium CVSS 3.1HIGH 8.8
- TI-2026-36600 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access CVSS 3.1CRITICAL 9.2
- TI-2026-40915 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces CVSS 3.1HIGH 8.9
Sources
- CVE-2023-27594 · CVE Program
- CVE-2023-27594 · NVD
- FIRST EPSS
- GHSA-8fg8-jh2h-f2hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences