CVE-2023-27593: Cilium Agent Container Access to Host via `hostPath` Mount
Summary
CVE-2023-27593: cilium-agent container can access the host via hostPath mount. Affects github.com/cilium/cilium across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
The same CVE-2023-27593 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Cilium package is an open-source project written in Go that provides networking and security services for containerized applications running on Kubernetes. It is designed to enhance the scalability, performance, and security of microservices-based applications. Cilium agent pods are responsible for managing network connectivity and security policies within the Kubernetes cluster.
Vulnerability Detail
The vulnerability identified as CVE-2023-27593 allows an attacker with access to a Cilium agent pod to gain unauthorized access to the underlying host. This is possible due to a hostPath mount of the /opt/cni/bin directory in the agent pod. By replacing the CNI binary with a malicious binary and waiting for the creation of a new pod on the node, the attacker can exploit this vulnerability. The impact of this vulnerability is significant as it grants unauthorized access to the host, potentially leading to further compromise of the entire Kubernetes cluster.
How To Fix
Latest published version: v1.20.3 as of 22 Oct 2026
go get github.com/cilium/cilium@v1.20.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15go get github.com/cilium/cilium@v1.11.15 -
>= 1.12.0, < 1.12.81.12.8go get github.com/cilium/cilium@v1.12.8 -
>= 1.13.0, < 1.13.11.13.1go get github.com/cilium/cilium@v1.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Cilium package is not immediately feasible, a workaround can be implemented using Kubernetes RBAC (Role-Based Access Control). By denying users and service accounts exec access to Cilium agent pods, the risk of exploitation can be reduced. However, in cases where a user requires exec access to Cilium agent pods but should not have access to the underlying node, no workaround is available.
Conclusion
The vulnerability in the Cilium package allows unauthorized access to the host via a hostPath mount. To mitigate this issue, it is crucial to update the package to the recommended versions. Implementing Kubernetes RBAC can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cilium/cilium →
FAQ
The vulnerability allows an attacker with access to a Cilium agent pod to gain unauthorized access to the underlying host. This can lead to further compromise of the Kubernetes cluster.
To fix this vulnerability, update the Cilium package to versions >=1.11.15, >=1.12.8, or >=1.13.1. These versions contain the necessary patches to mitigate the issue.
A workaround can be implemented using Kubernetes RBAC to deny exec access to Cilium agent pods. However, in cases where exec access is required, but access to the underlying node should be restricted, no workaround is available.
There are no known public exploits of this vulnerability at the time of this report. However, it is important to promptly update the Cilium package to prevent potential exploitation.
For more information, you can refer to the official Cilium GitHub repository and the provided references in the vulnerability details section.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cilium/cilium.
