CVE-2025-48056: Hubble CLI Character Injection Vulnerability
Summary
CVE-2025-48056: Character injection in Hubble CLI. Affects github.com/cilium/hubble versions < 1.17.2. Fixed in 1.17.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hubble CLI is a command-line interface tool developed by Cilium, designed for monitoring and troubleshooting network flows in Kubernetes environments. It provides visibility into Layer 7 protocols and integrates with Kafka for real-time data processing. However, it is susceptible to a character injection vulnerability that can compromise the integrity of its terminal output.
Vulnerability Detail
The vulnerability arises from the ability of a network attacker to inject malicious control characters into the Hubble CLI terminal output. This can lead to significant consequences, including the concealment of log entries, manipulation of output, or rendering the terminal temporarily unusable. Exploitation requires the victim to be actively monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack.
How To Fix
Latest published version: v1.20.2 as of 23 Oct 2026
go get github.com/cilium/hubble@v1.20.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.2
This is the first release that contains the fix.
go get github.com/cilium/hubble@v1.17.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users can redirect Hubble flows to a log file and inspect the output using a text editor. This can be achieved with the following command: hubble observe > output.log.
Conclusion
The character injection vulnerability in Hubble CLI (CVE-2025-48056) poses a moderate risk to users, allowing potential manipulation of terminal output. It is crucial to upgrade to version 1.17.2 or implement the suggested workaround to mitigate risks. Regular monitoring with tools like Vulert can enhance security by identifying vulnerabilities in real-time.
See every vulnerability recorded for github.com/cilium/hubble →
FAQ
It allows attackers to inject control characters into the terminal output, potentially manipulating or concealing important information.
The impacts include loss of integrity of log entries, manipulation of output, and making the terminal unusable.
Any version prior to 1.17.2 is affected. You can check your version by running hubble version.
You can redirect the output to a log file for inspection, which serves as a temporary workaround.
Vulert monitors open-source vulnerabilities in your software using the Gopkg.lock file, providing real-time alerts without requiring code access or installation.
