Network policy bypass vulnerability in Cilium
Summary
GHSA-c66w-hq56-4q97: Network policy may be bypassed by some ICMP Echo Requests. Affects github.com/cilium/cilium across 3 version ranges.
>= 1.7.8, < 1.7.15
>= 1.8.3, < 1.8.8
>= 1.9.0, < 1.9.5
Fixed in 1.7.15, 1.8.8 or 1.9.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project that provides networking and security services for containers and microservices. It is written in Go and is used to enforce network policies in Kubernetes environments. These network policies define rules for allowing or denying traffic between pods and external entities.
Vulnerability Detail
The vulnerability in Cilium allows ICMP Echo Requests to bypass network policies under specific conditions. Normally, network policies can be configured to disallow access from an actor (pod, cluster host, or remote host) to an endpoint, while allowing access from the endpoint to the actor. However, in this case, if the endpoint sends an ICMP Echo Request to the actor and the actor subsequently sends an ICMP Echo Request back to the endpoint before the conntrack entry is removed, the network policy may be bypassed. This vulnerability does not apply to UDP and TCP traffic.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.8, < 1.7.151.7.15go get github.com/cilium/cilium@v1.7.15 -
>= 1.8.3, < 1.8.81.8.8go get github.com/cilium/cilium@v1.8.8 -
>= 1.9.0, < 1.9.51.9.5go get github.com/cilium/cilium@v1.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The network policy bypass vulnerability in Cilium can allow ICMP Echo Requests to bypass network policies under specific conditions. It is recommended to update Cilium to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source project that provides networking and security services for containers and microservices in Kubernetes environments.
A network policy is a Kubernetes resource that defines rules for allowing or denying traffic between pods and external entities.
Under specific conditions, ICMP Echo Requests can bypass network policies that disallow access from an actor to an endpoint, but allow access from the endpoint to the actor.
The conditions for this vulnerability to be exploited are: 1) Network policies that disallow access from the actor to the endpoint, but allow access from the endpoint to the actor; 2) The endpoint sends an ICMP Echo Request to the actor with a specific ICMP identifier; 3) The actor sends an ICMP Echo Request back to the endpoint with the same ICMP identifier before the conntrack entry is removed.
No, there is no known workaround for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
