TI-2025-21502 Aliases CVE-2025-30163 GHSA-c6pf-2v8j-96mc

Node based network policies may incorrectly allow workload traffic

LOW 21CWE-863Published 2025-03-24 · Updated 2025-03-24

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0021 11th percentileScored 2026-11-07

Fix Partial cilium (cilium): 1.16.8, 1.17.2github.com/cilium/cilium (Go): 1.16.8, 1.17.2Red Hat: 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cilium	cilium	1.16.0 to before 1.16.8; 1.17.0 to before 1.17.2	1.16.8, 1.17.2	Patch available	CNA
—	github.com/cilium/cilium (Go)	1.16.0 to before 1.16.8	1.16.8	Patch available	GHSA-c6pf-2v8j-96mc
—	github.com/cilium/cilium (Go)	1.17.0 to before 1.17.2	1.17.2	Patch available	GHSA-c6pf-2v8j-96mc

cilium Vendorcilium Affected 1.16.0 to before 1.16.8; 1.17.0 to before 1.17.2 Fixed in 1.16.8, 1.17.2 Patch available CNA
github.com/cilium/cilium (Go) Vendor— Affected 1.16.0 to before 1.16.8 Fixed in 1.16.8 Patch available GHSA-c6pf-2v8j-96mc
github.com/cilium/cilium (Go) Vendor— Affected 1.17.0 to before 1.17.2 Fixed in 1.17.2 Patch available GHSA-c6pf-2v8j-96mc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cilium:cilium::::::::	1.16.0 to before 1.16.8; 1.17.0 to before 1.17.2	Vulnerable	cilium

cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* Versions 1.16.0 to before 1.16.8; 1.17.0 to before 1.17.2 Vulnerable ·cilium

Remediation

Fix · CNA cilium (cilium) Fixed in 1.16.8, 1.17.2
Fix · GHSA-c6pf-2v8j-96mc github.com/cilium/cilium (Go) Fixed in 1.16.8 Advisory →
Fix · GHSA-c6pf-2v8j-96mc github.com/cilium/cilium (Go) Fixed in 1.17.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Network Observability Operator	Affected	No fix yet: Fix deferred
OpenShift Developer Tools and Services	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 2	Affected	No fix yet: Fix deferred
Power monitoring for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift distributed tracing 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-30163
2026-10-03 Alias added: GHSA-c6pf-2v8j-96mc

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-30163

Other 2

TI-2024-32092 CIDR deny policies may not take effect when a more narrow CIDR allow is present CVSS 3.1HIGH 8.7
TI-2023-12305 Cilium eBPF filters may be temporarily removed during agent restart CVSS 3.1CRITICAL 9.8
TI-2023-20486 Cilium NetworkPolicy bypass via pod labels CVSS 3.1CRITICAL 9.0
TI-2022-11721 Incorrect Default Permissions in Cilium CVSS 3.1HIGH 8.8
TI-2026-36600 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access CVSS 3.1CRITICAL 9.2
TI-2026-40915 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces CVSS 3.1HIGH 8.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences