GHSA-5vxx-c285-pcq4 BIT-cilium-2025-32793 BIT-cilium-operator-2025-32793 BIT-hubble-relay-2025-32793 CVE-2025-32793 GO-2025-3635
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
- Severity
- 4.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.14%
- Chance of exploitation in the next 30 days. Higher than 3.54% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-319 Cleartext Transmission of Sensitive Information
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- Fix
1.15.16- Upgrade github.com/cilium/cilium to this version or later
Description
Impact
When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.
Patches
This issue has been patched in https://github.com/cilium/cilium/pull/38592.
This issue affects:
- Cilium v1.15 between v1.15.0 and v1.15.15 inclusive
- Cilium v1.16 between v1.16.0 and v1.16.8 inclusive
- Cilium v1.17 between v1.17.0 and v1.17.2 inclusive
This issue is fixed in:
- Cilium v1.15.16
- Cilium v1.16.9
- Cilium v1.17.3
Workarounds
There is no workaround to this issue.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch.
For more information
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/cilium/cilium | >= 1.13.0, < 1.15.16 |
1.15.16 |
| github.com/cilium/cilium | >= 1.16.0, < 1.16.9 |
1.16.9 |
| github.com/cilium/cilium | >= 1.17.0, < 1.17.3 |
1.17.3 |
| github.com/cilium/cilium | >= 1.13.0, < 1.15.16>= 1.16.0, < 1.16.9>= 1.17.0, < 1.17.3 |
1.15.161.16.91.17.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/cilium/cilium Go → 1.15.16
- go
go get github.com/cilium/cilium@v1.15.16 && go mod tidy
Severity breakdown
CVSS 3.1 4.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it
- Architecture and Design: In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
- Architecture and Design: Use thread-safe capabilities such as the data access abstraction in Spring.
- Architecture and Design: Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
- Implementation: When using multithreading and operating on shared variables, only use thread-safe functions.
- Implementation: Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
- Implementation: Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
- Implementation: Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
- Implementation: Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
- Implementation: Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fm8w-2m5w-9j7r Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match | Medium | Also affects github.com/cilium/cilium |
| GHSA-w7c2-w76w-5hmj Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces | High | Also affects github.com/cilium/cilium |
| GHSA-q6h5-q3q6-f87x CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation | Medium | Also affects github.com/cilium/cilium |
| GHSA-3fcv-jvfp-m4q9 Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access | High | Also affects github.com/cilium/cilium |
| GHSA-gj49-89wh-h4gj Cillium exposes sensitive information included in the cilium-bugtool debug archive | Medium | Also affects github.com/cilium/cilium |
| GHSA-hxv8-4j4r-cqgv Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic | Medium | Also affects github.com/cilium/cilium |
| GHSA-5r23-prx4-mqg3 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled | Medium | Also affects github.com/cilium/cilium |
| GHSA-38pp-6gcp-rqvm Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic | Medium | Also affects github.com/cilium/cilium |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor