CVE-2025-30163: Cilium incorrect authorization in node-based network policies

CVE-2025-30163 · Severity: low · CVSS 3.4 · Published 2025-03-24

Cilium is a networking and security tool used to manage traffic between applications in cloud environments. A vulnerability in its node-based network policies could allow unauthorized network traffic to reach certain parts of the system if they share the same identification labels as trusted nodes. This could lead to unauthorized data access, though the feature is disabled by default and requires specific configuration to be at risk.

Technologies: Cilium, github.com/cilium/cilium (Go). Vendors: Cilium, Go.

Quick answers

Is CVE-2025-30163 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-30163 being exploited in the wild.
How severe is CVE-2025-30163?
Low severity, with a CVSS score of 3.4, published 24 March 2025.
Which products and versions are affected?
Cilium >= 1.16.0, < 1.16.8; >= 1.17.0, < 1.17.2; github.com/cilium/cilium (Go) SEMVER:introduced=1.16.0,fixed=1.16.8, SEMVER:introduced=1.16.0,fixed=1.16.8,introduced=1.17.0,fixed=1.17.2.
Is there a fix for CVE-2025-30163?
Yes. github.com/cilium/cilium (Go): upgrade to 1.16.8, 1.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30163 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2025-30163?
Check whether you run Cilium or github.com/cilium/cilium (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cilium/cilium (Go): upgrade to 1.16.8, 1.17.2 or later
    go get github.com/cilium/cilium@v1.17.2

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Cilium's node-based network policies (fromNodes and toNodes). The root cause is that the policy engine incorrectly permits traffic to/from non-node endpoints if they share the same labels specified in the node-based policy sections. Exploitation requires the node-based policy feature to be enabled (it is disabled by default) and for an attacker to be on an adjacent network. An attacker could potentially bypass intended network isolation to access sensitive workloads. The issue is fixed in Cilium versions 1.16.8 and 1.17.2.

Affected products

  • Cilium Cilium >= 1.16.0, < 1.16.8; >= 1.17.0, < 1.17.2

Identifiers

  • CVE-2025-30163
  • GHSA-c6pf-2v8j-96mc
  • GO-2025-3561

Timeline

  • 2025-03-24: disclosed
  • 2025-03-24: advisory
  • 2025-03-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.