CVE-2025-64715Medium· 4.0▾ SunlitCilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended.
This issue has been patched in:
There is no workaround to this issue.
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @SeanEmac for reporting this issue and to @fristonio for the patch.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
github.com/cilium/cilium >= 1.18.0, < 1.18.4github.com/cilium/cilium >= 1.17.0, < 1.17.10github.com/cilium/cilium < 1.16.17Upgrade to a patched release:
github.com/cilium/cilium 1.18.4github.com/cilium/cilium 1.17.10github.com/cilium/cilium 1.16.17Connected by shared product, vendor, weakness, or advisory.
CVE-2024-25630Medium· 6.1Unencrypted ingress/health traffic when using Wireguard transparent encryption
CVE-2024-28248High· 7.2Intermittent HTTP policy bypass
CVE-2025-32793Medium· 4.0In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
CVE-2023-41333Medium· 6.9Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy
CVE-2023-27593Medium· 4.4cilium-agent container can access the host via `hostPath` mount
CVE-2024-47825Medium· 4.0Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present