CVE-2023-27594: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
Summary
CVE-2023-27594: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is github.com/cilium/cilium, which is written in Go. Cilium is an open-source software-defined networking (SDN) and network security project that aims to provide a scalable and efficient networking and security solution for containerized applications. It leverages Linux kernel features like eBPF (extended Berkeley Packet Filter) to enforce network policies and perform network-related tasks. This package is vulnerable to a potential network policy bypass when routing IPv6 traffic.
Vulnerability Detail
The vulnerability in github.com/cilium/cilium allows for a potential network policy bypass when routing IPv6 traffic. This means that an attacker could potentially bypass the defined network policies and gain unauthorized access to network resources or perform malicious activities. The vulnerability arises due to a flaw in the handling of IPv6 traffic routing. It affects versions 0.0.0 to 1.11.15, 1.12.0 to 1.12.8, and 1.13.0 to 1.13.1 of the package.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15go get github.com/cilium/cilium@v1.11.15 -
>= 1.12.0, < 1.12.81.12.8go get github.com/cilium/cilium@v1.12.8 -
>= 1.13.0, < 1.13.11.13.1go get github.com/cilium/cilium@v1.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the package to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in github.com/cilium/cilium allows for a potential network policy bypass when routing IPv6 traffic. It is crucial to update the package to the fixed versions to mitigate the risk of unauthorized access and potential malicious activities. Strengthening existing network policies can also help minimize the risk while updating the package.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
The vulnerability allows for a potential network policy bypass, which can lead to unauthorized access to network resources and potential malicious activities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes the Gopkg.lock file to identify vulnerable packages.
There are no known exploits for this vulnerability at the moment. However, it is important to update the package to the fixed versions to mitigate the risk.
The recommended approach is to update the package to the fixed versions. However, if updating is not immediately feasible, it is advised to review and strengthen the existing network policies to minimize the risk of a potential bypass.
You can find more information about this vulnerability in the vulnerability report on Vulert's website (https://vulert.com) by searching for the CVE identifier CVE-2023-27594.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
