PT-2025-12672 · Cilium · Cilium

Pjablonski123 · Published 2025-03-24 · Updated 2026-03-18 · CVE-2025-30162

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions 1.15.0 through 1.15.14 Cilium versions 1.16.0 through 1.16.7 Cilium versions 1.17.0 through 1.17.1

Description The issue affects Cilium users who use Gateway API for Ingress and LB-IPAM or BGP for LoadBalancer Service implementation, and also use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces. In such cases, egress traffic from workloads covered by these network policies to LoadBalancers configured by Gateway resources will be incorrectly allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected.

Recommendations For Cilium versions 1.15.0 through 1.15.14, update to version 1.15.15 to resolve the issue. For Cilium versions 1.16.0 through 1.16.7, update to version 1.16.8 to resolve the issue. For Cilium versions 1.17.0 through 1.17.1, update to version 1.17.2 to resolve the issue. As a temporary workaround for users who are unable to upgrade, a Clusterwide Cilium Network Policy can be used to mitigate this issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-CILIUM-2025-30162

BIT-CILIUM-OPERATOR-2025-30162

BIT-HUBBLE-RELAY-2025-30162

CVE-2025-30162

GHSA-24QP-4XX8-3JVJ

GO-2025-3560

OPENSUSE-SU-2025:14937-1

Affected Products

Cilium

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30162.json · Exploit
• https://github.com/cilium/cilium/security/advisories/GHSA-24qp-4xx8-3jvj · Patch
• https://github.com/cilium/proxy/pull/1172 · Patch
• https://osv.dev/vulnerability/BIT-cilium-operator-2025-30162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30162 · Security Note
• https://osv.dev/vulnerability/BIT-hubble-relay-2025-30162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-24qp-4xx8-3jvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30162 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2025-30162 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3560 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://suse.com/security/cve/CVE-2024-9900 · Note
• https://suse.com/security/cve/CVE-2024-53348 · Note
• https://suse.com/security/cve/CVE-2025-27612 · Note