CVE-2022-29179: Improper Privilege Management in Cilium
Summary
CVE-2022-29179: Improper Privilege Management in Cilium in github.com/cilium/cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2022-29179 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a Go-based open-source software package that provides networking and security services for containerized applications. It is commonly used in cloud-native environments to enforce network policies and secure communication between microservices. However, a vulnerability has been discovered in Cilium that could lead to improper privilege management.
Vulnerability Detail
The vulnerability in Cilium allows an attacker to bypass privilege management controls, potentially gaining unauthorized access to sensitive resources or performing malicious actions within the containerized environment. This vulnerability arises from a flaw in the implementation of privilege checks in Cilium. Attackers with limited privileges could exploit this vulnerability to escalate their privileges and execute arbitrary code.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16go get github.com/cilium/cilium@v1.9.16 -
>= 1.10.0, < 1.10.111.10.11go get github.com/cilium/cilium@v1.10.11 -
>= 1.11.0, < 1.11.51.11.5go get github.com/cilium/cilium@v1.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Cilium to the fixed versions mentioned above to address the issue effectively.
Conclusion
The vulnerability in Cilium's privilege management poses a significant risk to containerized environments. It is crucial to update Cilium to the fixed versions to mitigate this vulnerability and ensure the security of the application.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source software package written in Go that provides networking and security services for containerized applications. It is commonly used in cloud-native environments.
The vulnerability allows attackers to bypass privilege management controls in Cilium, potentially leading to unauthorized access to sensitive resources or execution of arbitrary code.
To fix this vulnerability, update Cilium to version 1.9.16, 1.10.11, or 1.11.5, depending on the current version in use.
No, there are no known workarounds for this vulnerability. Updating to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the official vulnerability report provided by the Go ecosystem.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
