Vulnerability in github.com/cilium/cilium
Summary
GO-2022-0959: Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium. Affects github.com/cilium/cilium across 3 version ranges.
< 1.10.14
>= 1.11.0, < 1.11.8
>= 1.12.0, < 1.12.1
Fixed in 1.10.14, 1.11.8 or 1.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/cilium/cilium is written in Go and is used for Network Policies and Clusterwide Cilium Network Policies. It provides functionality for selecting pods based on namespace label selectors. However, a vulnerability has been discovered in this package that allows the selection of pods with maliciously crafted labels.
Vulnerability Detail
The vulnerability in github.com/cilium/cilium occurs when Network Policies or Clusterwide Cilium Network Policies with namespace label selectors unexpectedly select pods with maliciously crafted labels. This can lead to unauthorized access or manipulation of pods by an attacker. The vulnerability affects versions 0.0.0 to 1.10.14, 1.11.0 to 1.11.8, and 1.12.0 to 1.12.1 of the package.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.10.141.10.14go get github.com/cilium/cilium@v1.10.14 -
>= 1.11.0, < 1.11.81.11.8go get github.com/cilium/cilium@v1.11.8 -
>= 1.12.0, < 1.12.11.12.1go get github.com/cilium/cilium@v1.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of the package.
Conclusion
The vulnerability in github.com/cilium/cilium allows the selection of pods with malicious labels, which can result in unauthorized access or manipulation of pods. It is crucial to update to the fixed versions (1.10.14, 1.11.8, or 1.12.1) of the package to mitigate this vulnerability.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
This vulnerability allows attackers to select pods with malicious labels, potentially leading to unauthorized access or manipulation of pods.
Versions 0.0.0 to 1.10.14, 1.11.0 to 1.11.8, and 1.12.0 to 1.12.1 of the package are affected.
No, there are no known workarounds for this vulnerability. It is recommended to update to the fixed versions of the package.
To update to the fixed version, you can use the package manager or dependency management tool for your Go project and specify the desired version (1.10.14, 1.11.8, or 1.12.1) of github.com/cilium/cilium.
You can find more information about this vulnerability in the vulnerability database entry at https://pkg.go.dev/vuln/GO-2022-0959.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
