Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
Cilium: IPv6 Traffic Can Bypass Network Security Rules
published 4 years ago
Summary
Cilium, a network security software, has a flaw that allows certain IPv6 traffic to bypass security rules on some Linux systems. This could allow malicious traffic to reach sensitive areas of the network. To fix this issue, update Cilium to version v1.10.13 or v1.11.7, or implement network policies that restrict traffic to the local node.
What to do
- Update github.com cilium to version 1.10.13.
- Update github.com cilium to version 1.11.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | cilium |
< 1.10.13 >= 1.11.0, < 1.11.7 Fix: upgrade to 1.10.13
|
Original advisory text
Cilium host policy bypass in endpoint-routes mode with dual-stack
### Impact
This vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace (e.g., to a host-network pod). Host policy enforcement on IPv4 or for traffic coming from outside the node is not affected.
Cilium is only affected by this vulnerability if IPv4, IPv6, endpoint routes, and the host firewall are enabled. Note that endpoint routes are typically only enabled in GKE, EKS, AKS, and OpenShift; in those environments, IPv6 is typically disabled. Host firewall is disabled by default.
### Patches
The bug is fixed in versions v1.10.13 and v1.11.7 of Cilium.
### Workarounds
For affected users who can't upgrade, one potential workaround is to ensure all pods have network policies that prevent sending arbitrary traffic to the local node.
### References
Commit fixing the vulnerability: https://github.com/cilium/cilium/commit/c758da7e9d19cd19b96dc90424c0b5ec7409cd0a.
### For more information
If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).
As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [[email protected]](mailto:[email protected])—first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
This vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace (e.g., to a host-network pod). Host policy enforcement on IPv4 or for traffic coming from outside the node is not affected.
Cilium is only affected by this vulnerability if IPv4, IPv6, endpoint routes, and the host firewall are enabled. Note that endpoint routes are typically only enabled in GKE, EKS, AKS, and OpenShift; in those environments, IPv6 is typically disabled. Host firewall is disabled by default.
### Patches
The bug is fixed in versions v1.10.13 and v1.11.7 of Cilium.
### Workarounds
For affected users who can't upgrade, one potential workaround is to ensure all pods have network policies that prevent sending arbitrary traffic to the local node.
### References
Commit fixing the vulnerability: https://github.com/cilium/cilium/commit/c758da7e9d19cd19b96dc90424c0b5ec7409cd0a.
### For more information
If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).
As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [[email protected]](mailto:[email protected])—first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Jul 2022
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-wc5v-r48v-g4vh · GHSA
Track software like this
Free during beta