Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-319.
Summary
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cilium | cilium | v1.13.0 to before v1.15.16; v1.16.0 to before v1.16.9; v1.17.0 to before v1.17.3 | v1.15.16, v1.16.9, v1.17.3 | Patch available | CNA |
| — | github.com/cilium/cilium (Go) | 1.13.0 to before 1.15.16 | 1.15.16 | Patch available | GHSA-5vxx-c285-pcq4 |
| — | github.com/cilium/cilium (Go) | 1.16.0 to before 1.16.9 | 1.16.9 | Patch available | GHSA-5vxx-c285-pcq4 |
| — | github.com/cilium/cilium (Go) | 1.17.0 to before 1.17.3 | 1.17.3 | Patch available | GHSA-5vxx-c285-pcq4 |
- cilium Vendorcilium Affected v1.13.0 to before v1.15.16; v1.16.0 to before v1.16.9; v1.17.0 to before v1.17.3 Fixed in v1.15.16, v1.16.9, v1.17.3 Patch available CNA
- github.com/cilium/cilium (Go) Vendor— Affected 1.13.0 to before 1.15.16 Fixed in 1.15.16 Patch available GHSA-5vxx-c285-pcq4
- github.com/cilium/cilium (Go) Vendor— Affected 1.16.0 to before 1.16.9 Fixed in 1.16.9 Patch available GHSA-5vxx-c285-pcq4
- github.com/cilium/cilium (Go) Vendor— Affected 1.17.0 to before 1.17.3 Fixed in 1.17.3 Patch available GHSA-5vxx-c285-pcq4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* | 1.13.0 to before 1.15.16; 1.16.0 to before 1.16.9; 1.17.0 to before 1.17.3 | Vulnerable | cilium |
- cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* Versions 1.13.0 to before 1.15.16; 1.16.0 to before 1.16.9; 1.17.0 to before 1.17.3 Vulnerable ·cilium
Remediation
- Fix · CNA cilium (cilium) Fixed in v1.15.16, v1.16.9, v1.17.3
- Fix · GHSA-5vxx-c285-pcq4 github.com/cilium/cilium (Go) Fixed in 1.15.16 Advisory →
- Fix · GHSA-5vxx-c285-pcq4 github.com/cilium/cilium (Go) Fixed in 1.16.9 Advisory →
- Fix · GHSA-5vxx-c285-pcq4 github.com/cilium/cilium (Go) Fixed in 1.17.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32793
- 2026-10-03 Alias added: GHSA-5vxx-c285-pcq4
References
More Cilium vulnerabilities
- TI-2024-32092 CIDR deny policies may not take effect when a more narrow CIDR allow is present CVSS 3.1HIGH 8.7
- TI-2023-12305 Cilium eBPF filters may be temporarily removed during agent restart CVSS 3.1CRITICAL 9.8
- TI-2023-20486 Cilium NetworkPolicy bypass via pod labels CVSS 3.1CRITICAL 9.0
- TI-2022-11721 Incorrect Default Permissions in Cilium CVSS 3.1HIGH 8.8
- TI-2026-36600 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access CVSS 3.1CRITICAL 9.2
- TI-2026-40915 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces CVSS 3.1HIGH 8.9
Sources
- CVE-2025-32793 · CVE Program
- CVE-2025-32793 · NVD
- FIRST EPSS
- GHSA-5vxx-c285-pcq4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences