CVE-2025-64715
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Cilium prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicies using egress.toGroups.aws.securityGroupsIds referencing non-existent or unattached AWS security groups may unintentionally allow broader outbound access than intended. The toCIDRset section of the derived policy is not generated, permitting traffic to more destinations.
Risk Assessment
Unexpectedly broad egress from the cluster may weaken network controls and increase attack surface. Kubernetes clusters using AWS security group-based policies are at risk.
Recommendation
Upgrade Cilium to versions 1.16.17, 1.17.10, or 1.18.4. There are no workarounds — upgrading is required.
Other vulnerabilities in Cilium
See all- CVE-2026-41520High
Cilium, a networking, observability, and security solution, prior to versions 1.17.15, 1.18.9, and 1.19.3, could output sensitive data when the cilium-bugtool was run against deployments with WireGuard encryption enabled.
- CVE-2026-49445Critical
In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.
- CVE-2026-56743Medium
A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.
- CVE-2026-56742Medium
A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.
- CVE-2026-53935Medium
A vulnerability in Cilium allows users with the ability to create CiliumLocalRedirectPolicies to hijack traffic to Services in any namespace by specifying arbitrary ClusterIPs via addressMatcher. Deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service.
- CVE-2023-34242Low
Cilium, a networking, observability, and security solution, prior to version 1.13.4 had a vulnerability that allowed unintended access to secrets and services across namespaces when Gateway API was enabled. The lack of namespace checks when creating ReferenceGrant allowed attackers to use secrets that should not be visible to them.
Original NVD description (English source)
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS