github.com/cilium/cilium vulnerabilities

CVEs whose affected-version data names the github.com/cilium/cilium package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

github.com/cilium/cilium vulnerabilities

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present

Intermittent HTTP policy bypass

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy

Specific Cilium configurations vulnerable to DoS via Kubernetes annotations

Potential HTTP policy bypass when using header rules in Cilium

cilium-agent container can access the host via `hostPath` mount

Access to Unix domain socket can lead to privileges escalation in Cilium