CVE-2024-37307: Cilium Leaks Sensitive Information in cilium-bugtool
Summary
CVE-2024-37307: Cilium leaks sensitive information in cilium-bugtool. Affects github.com/cilium/cilium across 3 version ranges.
>= 1.13.0, < 1.13.17
>= 1.14.0, < 1.14.12
>= 1.15.0, < 1.15.6
Fixed in 1.13.17, 1.14.12 or 1.15.6, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- hubble · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2024-37307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cilium is an open-source networking and security project that provides API-aware network security and observability for containers and microservices. It utilizes the Envoy proxy to enforce security policies and enable advanced networking features. The vulnerability affects Cilium deployments with the Envoy proxy enabled, specifically impacting features such as TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering.
Vulnerability Detail
The vulnerability arises from the output of the cilium-bugtool debugging tool when run with the --envoy-dump flag against Cilium deployments with the Envoy proxy enabled. This tool can inadvertently expose sensitive data, including the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, as well as API keys used in Kafka-related network policies. The leaked information can have severe consequences, compromising the security of TLS inspection, TLS termination, and Kafka network policies.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.13.0, < 1.13.171.13.17go get github.com/cilium/cilium@v1.13.17 -
>= 1.14.0, < 1.14.121.14.12go get github.com/cilium/cilium@v1.14.12 -
>= 1.15.0, < 1.15.61.15.6go get github.com/cilium/cilium@v1.15.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches to mitigate the issue effectively.
Conclusion
The vulnerability in Cilium's cilium-bugtool can lead to the exposure of sensitive information, compromising the security of TLS inspection, TLS termination, and Kafka network policies. It is crucial to upgrade to the patched versions of Cilium (v1.13.17, v1.14.12, or v1.15.6) to mitigate this issue. If you have further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
The vulnerability can expose sensitive information, including CA certificates, certificate chains, private keys, and API keys. This can lead to unauthorized access, compromised TLS inspection and termination, and potential security breaches in Kafka network policies.
Cilium v1.13 (v1.13.0 to v1.13.16), Cilium v1.14 (v1.14.0 to v1.14.11), and Cilium v1.15 (v1.15.0 to v1.15.5) are affected by this vulnerability.
You can use the cilium-bugtool with the --envoy-dump flag against your Cilium deployment. If it leaks sensitive information, your deployment is vulnerable.
No, there are no known workarounds for this vulnerability. Applying the provided patches is the recommended solution.
If you have discovered a vulnerability in Cilium, please report it to the Cilium security team by emailing security@cilium.io. They treat vulnerability reports as a top priority.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
