Executive brief
Cilium is a networking and security tool used to manage traffic between applications in cloud environments. A configuration issue in how it handles AWS security groups can cause network policies to fail silently, potentially allowing applications to communicate with unauthorized external destinations. This could lead to unintended data exposure if outbound traffic is not properly restricted as intended by administrators.
Technical details
A vulnerability in Cilium's policy engine occurs when a CiliumNetworkPolicy uses 'egress.toGroups.aws.securityGroupsIds' to reference AWS security group IDs that either do not exist or are not attached to any network interface. In these specific scenarios, the 'toCIDRset' section of the derived policy is not generated. This root cause leads to a failure in applying intended egress restrictions, potentially allowing broader outbound access than defined. The issue is classified as Improper Access Control (CWE-284) and has been addressed in versions 1.18.4, 1.17.10, and 1.16.17.
Affected products
- Cilium Cilium >= 1.18.0, < 1.18.4; >= 1.17.0, < 1.17.10; <= 1.16.16
Timeline
- 2025-11-27: disclosed
- 2025-11-29: advisory: NVD publication
- 2025-12-01: advisory: GitHub Advisory published