CVE-2024-28249: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
Summary
CVE-2024-28249: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.13.13
>= 1.14.0, < 1.14.8
>= 1.15.0, < 1.15.2
Fixed in 1.13.13, 1.14.8 or 1.15.2, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2024-28249 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/cilium/cilium, which is written in Go. Cilium is a networking and security project that provides API-aware network security using eBPF (extended Berkeley Packet Filter) and XDP (eXpress Data Path) technology. It aims to secure the communication between microservices in a Kubernetes cluster. Cilium leverages Envoy proxies and IPsec encryption to protect traffic between nodes and pods. However, a vulnerability has been identified in Cilium clusters with IPsec enabled, where traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted. Similarly, traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is also sent unencrypted.
Vulnerability Detail
The vulnerability in github.com/cilium/cilium allows for unencrypted traffic between nodes with IPsec. This means that sensitive data transmitted between a node's Envoy proxy and pods on other nodes, as well as between a node's DNS proxy and pods on other nodes, can be intercepted and read by malicious actors. This poses a significant security risk as it undermines the confidentiality of the communication within the Cilium cluster. The vulnerability affects versions 0.x, 1.13.13 - 1.14.8, and 1.15.0 - 1.15.2 of the package.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.131.13.13go get github.com/cilium/cilium@v1.13.13 -
>= 1.14.0, < 1.14.81.14.8go get github.com/cilium/cilium@v1.14.8 -
>= 1.15.0, < 1.15.21.15.2go get github.com/cilium/cilium@v1.15.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of github.com/cilium/cilium to address the issue.
Conclusion
In conclusion, the vulnerability in github.com/cilium/cilium allows for unencrypted traffic between nodes with IPsec, compromising the confidentiality of the communication within the Cilium cluster. To address this issue, it is crucial to upgrade to a fixed version of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
The impact of this vulnerability is that sensitive data transmitted between a node's Envoy proxy and pods on other nodes, as well as between a node's DNS proxy and pods on other nodes, can be intercepted and read by malicious actors.
The vulnerability affects versions 0.x, 1.13.13 - 1.14.8, and 1.15.0 - 1.15.2 of github.com/cilium/cilium.
No, there are no known workarounds for this vulnerability. It is necessary to upgrade to a fixed version of github.com/cilium/cilium.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
For more information about this vulnerability, you can visit the VulnDB entry at https://pkg.go.dev/vuln/GO-2024-2656.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
