CVE-2025-67499Medium· 6.6▾ SunlitThe CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
cni_network_plugins >= 1.6.0, < 1.9.0Upgrade past the affected range:
cni_network_plugins 1.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106501Critical· 9.6Backstage is an open framework for building developer portals
CVE-2026-106459High· 8.5Backstage is an open framework for building developer portals
CVE-2025-66623High· 7.4Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations
CVE-2024-21626High· 8.6runc is a CLI tool for spawning and running containers on Linux according to the OCI specification
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2025-61916High· 7.9Spinnaker is an open source, multi-cloud continuous delivery platform