CVE-2025-30163

Katalog CVE

CVSS 4.7 · Medium EPSS 0,21%

Kerentanan Incorrect Authorization pada cilium. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.

Rincian

Terbit di NVD

24 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cilium/cilium/pull/36657 patch
• https://github.com/cilium/cilium/security/advisories/GHSA-c6pf-2v8j-96mc mitigasi · patch · advisory pihak ketiga
• https://docs.cilium.io/en/stable/security/policy/language/#node-based product