Cilium host policy bypass in endpoint-routes mode with dual-stack
Summary
GHSA-wc5v-r48v-g4vh: Cilium host policy bypass in endpoint-routes mode with dual-stack. Affects github.com/cilium/cilium across 2 version ranges.
< 1.10.13
>= 1.11.0, < 1.11.7
Fixed in 1.10.13 or 1.11.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project that provides networking and security for containers and microservices. It is written in Go and is commonly used in Kubernetes environments. Cilium enables fine-grained network policies and implements them using eBPF (extended Berkeley Packet Filter) technology. These policies control the traffic between pods and enforce security rules. However, a vulnerability has been discovered in Cilium's host policy enforcement when using endpoint-routes mode with dual-stack.
Vulnerability Detail
The vulnerability allows for the bypassing of host policies for IPv6 traffic originating from a Cilium-managed pod and destined for the host-network namespace. This means that an attacker could potentially send malicious IPv6 traffic to a host-network pod without being subject to the intended security policies. It's important to note that this vulnerability only affects Cilium if IPv4, IPv6, endpoint routes, and the host firewall are enabled. In typical environments like GKE, EKS, AKS, and OpenShift, endpoint routes are enabled but IPv6 is disabled. The host firewall is also disabled by default.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.10.131.10.13go get github.com/cilium/cilium@v1.10.13 -
>= 1.11.0, < 1.11.71.11.7go get github.com/cilium/cilium@v1.11.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users who cannot immediately upgrade to the fixed versions, one potential workaround is to implement network policies for all pods that prevent them from sending arbitrary traffic to the local node. This can help mitigate the risk of the vulnerability until a proper upgrade can be performed.
Conclusion
The Cilium host policy bypass vulnerability in endpoint-routes mode with dual-stack can allow for the bypassing of host policies for IPv6 traffic from Cilium-managed pods to the host-network namespace. This can potentially lead to unauthorized access or malicious activities. It is crucial for affected users to upgrade to the fixed versions (v1.10.13 or v1.11.7) of Cilium to ensure the correct enforcement of host policies. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium versions prior to v1.10.13 and v1.11.7 are affected by this vulnerability.
No, this vulnerability only affects IPv6 traffic coming from a Cilium-managed pod and destined for the host-network namespace.
Yes, this vulnerability is more likely to be present in environments like GKE, EKS, AKS, and OpenShift, where endpoint routes are typically enabled.
The host firewall is disabled by default in Cilium.
No, upgrading to the fixed versions is the recommended solution to address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
