Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2025-64715: Cilium allows unintended outbound traffic when policy mis‑references AWS groups
CVE-2025-64715 · published 11 months ago
Summary
If you run Cilium versions older than the latest patches, rules that point to AWS security groups that don’t exist can cause the system to let more outbound traffic through than you intended. This happens because the software fails to create the proper list of allowed destinations. Upgrade Cilium to version 1.16.17, 1.17.10, or 1.18.4 to fix the issue; there is no other workaround.
What to do
- Update github.com cilium to version 1.18.4.
- Update ciliumgithub.com cilium to version 1.17.10.
- Update github.com cilium to version 1.16.17.
- Update github.com cilium to version 1.17.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | cilium |
>= 1.18.0, < 1.18.4 < 1.16.17 >= 1.17.0, < 1.17.10 Fix: upgrade to 1.18.4
|
| go | ciliumgithub.com | cilium |
>= 1.17.0, < 1.17.10 Fix: upgrade to 1.17.10
|
| – | cilium | cilium |
< 1.16.17 >= 1.17.0, < 1.17.10 >= 1.18.0, < 1.18.4 cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* |
Original advisory text
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
References
- https://github.com/advisories/GHSA-38pp-6gcp-rqvm
- https://nvd.nist.gov/vuln/detail/CVE-2025-64715 Vendor Advisory
- https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64715... Vendor Advisory
- https://github.com/cilium/cilium/releases/tag/v1.16.17 URL
- https://github.com/cilium/cilium/releases/tag/v1.17.10 URL
- https://github.com/cilium/cilium/releases/tag/v1.18.4 URL
- https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published29 Nov 2025
Updated30 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta