CVE-2022-29178: Privilege Escalation in Cilium via Unix Domain Socket
Summary
CVE-2022-29178: Access to Unix domain socket can lead to privileges escalation in Cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2022-29178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project written in Go that provides networking and security capabilities for Kubernetes. It enables the implementation of network and security policies at the network layer and offers features like load balancing, network visibility, and encryption. Cilium runs as a daemon on each Kubernetes node and communicates with the Kubernetes API server to enforce network policies. It utilizes Unix domain sockets for inter-process communication.
Vulnerability Detail
This vulnerability in Cilium allows users with host file system access on a node and the privileges to run as group ID 1000 to gain access to the per node API of Cilium via Unix domain socket on the host where Cilium is running. If a malicious user gains unprivileged access to a user corresponding to this group, they can exploit this access to compromise the integrity and availability of the system. Operating systems that have unprivileged users not belonging to group ID 1000 are not affected. The vulnerability has a CVSS score of 8.8 (High).
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16go get github.com/cilium/cilium@v1.9.16 -
>= 1.10.0, < 1.10.111.10.11go get github.com/cilium/cilium@v1.10.11 -
>= 1.11.0, < 1.11.51.11.5go get github.com/cilium/cilium@v1.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Cilium is not immediately possible, a temporary workaround is to prevent Cilium from running with group 1000. This can be achieved by modifying Cilium's DaemonSet configuration to include the following command:
containers:
- name: cilium-agent
args:
- -c
- "groupdel cilium && cilium-agent --config-dir=/tmp/cilium/config-map"
command:
- bash
This will remove the group 1000 and run Cilium with the default root group.
Conclusion
The vulnerability in Cilium allows unauthorized access to the per node API via Unix domain socket, potentially compromising system integrity and availability. It is recommended to update Cilium to the latest versions or apply the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source project that provides networking and security capabilities for Kubernetes. It enables the implementation of network and security policies at the network layer and offers features like load balancing, network visibility, and encryption.
This vulnerability allows users with host file system access and the privileges to run as group ID 1000 to gain unauthorized access to the per node API of Cilium via Unix domain socket. This can lead to compromise of system integrity and availability.
Versions of Cilium prior to 1.9.16, 1.10.11, and 1.11.5 are affected by this vulnerability.
Yes, a temporary workaround is to modify Cilium's DaemonSet configuration to prevent it from running with group 1000. This can be achieved by removing the group 1000 and running Cilium with the default root group.
The CVSS score of this vulnerability is 8.8 (High).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
