TI-2023-12305 Aliases CVE-2023-27595 GHSA-r5x6-w42p-jhpp

Cilium eBPF filters may be temporarily removed during agent restart

MEDIUM 43CWE-755Published 2023-03-17 · Updated 2025-02-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a short period when Cilium eBPF programs are not attached to the host. During this period, the host does not implement any of Cilium's featureset. This can cause disruption to newly established connections during this period due to the lack of Load Balancing, or can cause Network Policy bypass due to the lack of Network Policy enforcement during the window. This vulnerability impacts any Cilium-managed endpoints on the node (such as Kubernetes Pods), as well as the host network namespace (including Host Firewall). This vulnerability is fixed in Cilium 1.13.1 or later. Cilium releases 1.12.x, 1.11.x, and earlier are not affected. There are no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00734 54th percentileScored 2026-11-07

Fix Fixed github.com/cilium/cilium (Go): 1.13.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cilium	cilium	= 1.13.0	—	No fix listed	CNA
—	github.com/cilium/cilium (Go)	1.13.0 to before 1.13.1	1.13.1	Patch available	GHSA-r5x6-w42p-jhpp

cilium Vendorcilium Affected = 1.13.0 Fixed in — No fix listed CNA
github.com/cilium/cilium (Go) Vendor— Affected 1.13.0 to before 1.13.1 Fixed in 1.13.1 Patch available GHSA-r5x6-w42p-jhpp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cilium:cilium:1.13.0:::::::*	1.13.0	Vulnerable	cilium

cpe:2.3:a:cilium:cilium:1.13.0:*:*:*:*:*:*:* Versions 1.13.0 Vulnerable ·cilium

Remediation

Fix · GHSA-r5x6-w42p-jhpp github.com/cilium/cilium (Go) Fixed in 1.13.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-27595
2026-10-03 Alias added: GHSA-r5x6-w42p-jhpp

References

Advisory 4

Other 1

https://github.com/cilium/cilium

TI-2024-32092 CIDR deny policies may not take effect when a more narrow CIDR allow is present CVSS 3.1HIGH 8.7
TI-2023-20486 Cilium NetworkPolicy bypass via pod labels CVSS 3.1CRITICAL 9.0
TI-2022-11721 Incorrect Default Permissions in Cilium CVSS 3.1HIGH 8.8
TI-2026-36600 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access CVSS 3.1CRITICAL 9.2
TI-2026-40915 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces CVSS 3.1HIGH 8.9
TI-2022-11722 Improper Privilege Management in Cilium CVSS 3.1HIGH 8.2

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences