Vulnerability in Cilium Network Policies with Namespace Label Selectors
Summary
GHSA-pfhr-pccp-hwmh: Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes po... Affects github.com/cilium/cilium across 3 version ranges.
< 1.10.14
>= 1.11.0, < 1.11.8
>= 1.12.0, < 1.12.1
Fixed in 1.10.14, 1.11.8 or 1.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open-source project that provides network and security connectivity for applications running on Kubernetes. It offers advanced networking features and implements network policies to control traffic between pods. Network Policies allow users to define rules for pod communication based on labels. However, a vulnerability has been discovered in Cilium Network Policies with namespace label selectors.
Vulnerability Detail
The vulnerability arises when a user configures Network Policies with namespace selectors that select labels of namespaces, or (clusterwide) Cilium Network Policies that match on namespace labels. In such cases, an attacker with Kubernetes pod deploy rights can craft additional pod labels to deceive the system. This manipulation can cause the pod to be selected by a different policy than intended, potentially leading to unauthorized access or malicious actions.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.10.141.10.14go get github.com/cilium/cilium@v1.10.14 -
>= 1.11.0, < 1.11.81.11.8go get github.com/cilium/cilium@v1.11.8 -
>= 1.12.0, < 1.12.11.12.1go get github.com/cilium/cilium@v1.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds available for this vulnerability. It is essential to update to the fixed versions mentioned above to mitigate the risk.
Conclusion
The vulnerability in Cilium Network Policies with Namespace Label Selectors can allow an attacker to bypass intended policies and gain unauthorized access or perform malicious actions. It is crucial to update to the fixed versions (1.10.14, 1.11.8, or 1.12.1) to ensure the system is secure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
Cilium is an open-source project that provides network and security connectivity for applications running on Kubernetes. It offers advanced networking features and implements network policies to control traffic between pods.
Network Policies allow users to define rules for pod communication based on labels. These policies help enforce security and control traffic flow within a Kubernetes cluster.
The vulnerability occurs when Network Policies with namespace selectors or (clusterwide) Cilium Network Policies matching on namespace labels are configured. An attacker can manipulate pod labels to bypass intended policies and gain unauthorized access or perform malicious actions.
The impact of this vulnerability is that an attacker with Kubernetes pod deploy rights can deceive the system by crafting additional pod labels. This can lead to the pod being selected by a different policy than intended, potentially resulting in unauthorized access or malicious actions.
To fix this vulnerability, it is recommended to update to the latest versions of Cilium (1.10.14, 1.11.8, or 1.12.1). These versions contain the necessary patches to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
