CVE-2025-30163: Cilium incorrect authorization in node-based network policies

Executive brief

Cilium is a networking and security tool used to manage traffic between applications in cloud environments. A vulnerability in its node-based network policies could allow unauthorized network traffic to reach certain parts of the system if they share the same identification labels as trusted nodes. This could lead to unauthorized data access, though the feature is disabled by default and requires specific configuration to be at risk.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Cilium's node-based network policies (fromNodes and toNodes). The root cause is that the policy engine incorrectly permits traffic to/from non-node endpoints if they share the same labels specified in the node-based policy sections. Exploitation requires the node-based policy feature to be enabled (it is disabled by default) and for an attacker to be on an adjacent network. An attacker could potentially bypass intended network isolation to access sensitive workloads. The issue is fixed in Cilium versions 1.16.8 and 1.17.2.

Affected products

• Cilium Cilium >= 1.16.0, < 1.16.8; >= 1.17.0, < 1.17.2

Timeline

• 2025-03-24: disclosed
• 2025-03-24: advisory
• 2025-03-24: patched

References

• https://api.github.com/users/oblazek
• https://github.com/oblazek
• https://api.github.com/users/oblazek/gists%7B/gist_id%7D
• https://api.github.com/users/oblazek/repos
• https://avatars.githubusercontent.com/u/15906154?v=4
• https://api.github.com/users/oblazek/events%7B/privacy%7D