CVE-2023-41333: Cilium Vulnerable to Bypass of Namespace Restrictions
Summary
CVE-2023-41333: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2023-41333 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project written in Go that provides network and security connectivity for applications running on Kubernetes. It offers enhanced networking features and implements network policies to enforce security rules within Kubernetes clusters. However, a vulnerability has been discovered in CiliumNetworkPolicy, which allows for the bypass of namespace restrictions.
Vulnerability Detail
The vulnerability in CiliumNetworkPolicy allows an attacker to bypass namespace restrictions, potentially leading to unauthorized access and privilege escalation within a Kubernetes cluster. This vulnerability affects versions 0.x, 1.12.14, 1.13.0 - 1.13.7, and 1.14.0 - 1.14.2 of the github.com/cilium/cilium package.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14go get github.com/cilium/cilium@v1.12.14 -
>= 1.13.0, < 1.13.71.13.7go get github.com/cilium/cilium@v1.13.7 -
>= 1.14.0, < 1.14.21.14.2go get github.com/cilium/cilium@v1.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a fixed version of the Cilium package to mitigate the risk.
Conclusion
The vulnerability in CiliumNetworkPolicy allows for the bypass of namespace restrictions, potentially leading to unauthorized access and privilege escalation within a Kubernetes cluster. Users are advised to upgrade to a fixed version of the Cilium package to mitigate this vulnerability.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source project that provides network and security connectivity for applications running on Kubernetes.
CiliumNetworkPolicy is a component of Cilium that enforces network security policies within Kubernetes clusters.
Namespace restrictions define the boundaries and access controls for resources within a Kubernetes namespace.
This vulnerability could allow an attacker to bypass namespace restrictions and gain unauthorized access to resources within a Kubernetes cluster, potentially leading to further compromise or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your Cilium installation is affected by this vulnerability. No signup is required, and Vulert will analyze your Gopkg.lock file to provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
