CVE-2024-42488: Policy bypass for Host Firewall policy due to race condition in Cilium agent
Summary
CVE-2024-42488: Policy bypass for Host Firewall policy due to race condition in Cilium agent. Affects github.com/cilium/cilium across 2 version ranges.
< 1.14.14
>= 1.15.0, < 1.15.8
Fixed in 1.14.14 or 1.15.8, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2024-42488 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project that provides networking and security services for containers and microservices. It is written in Go and is designed to enhance the networking capabilities of Kubernetes. Cilium allows users to define network policies to control traffic between containers and enforce security rules. However, a vulnerability has been discovered in the Cilium agent that can lead to a policy bypass due to a race condition.
Vulnerability Detail
The race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This can result in CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to a policy bypass. This vulnerability affects all versions of Cilium before v1.14.14 and Cilium v1.15 between v1.15.0 and v1.15.7 inclusive. The impact of this vulnerability is moderate, with a CVSS score of 6.8.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.14.141.14.14go get github.com/cilium/cilium@v1.14.14 -
>= 1.15.0, < 1.15.81.15.8go get github.com/cilium/cilium@v1.15.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, users can restart the Cilium agent on affected nodes. This can help mitigate the issue until the affected policies are confirmed to be working as expected.
Conclusion
The race condition vulnerability in the Cilium agent can lead to a policy bypass, potentially allowing unauthorized traffic. Users are advised to upgrade to the patched versions of Cilium (v1.14.14 or v1.15.8) to mitigate this vulnerability. If immediate upgrading is not possible, restarting the Cilium agent on affected nodes can provide temporary relief.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source project that provides networking and security services for containers and microservices. It enhances the networking capabilities of Kubernetes.
The vulnerability can lead to a policy bypass, allowing unauthorized traffic to bypass network policies defined in Cilium.
All versions of Cilium before v1.14.14 and Cilium v1.15 between v1.15.0 and v1.15.7 inclusive are affected.
To fix this vulnerability, upgrade to the patched versions of Cilium (v1.14.14 or v1.15.8).
If upgrading is not immediately possible, restarting the Cilium agent on affected nodes can help mitigate the issue temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
