PT-2026-30013 · Vmware · Antreas

Antoninbas · Published 2026-04-03 · Updated 2026-04-27 · CVE-2026-34992

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Antrea versions prior to 2.4.5 and 2.5.2

Description Antrea, a Kubernetes networking solution, has a missing encryption issue affecting inter-Node Pod traffic. In dual-stack networking clusters with IPsec encryption enabled (trafficEncryptionMode: ipsec), IPv6 Pod traffic is not encrypted, while IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload). This occurs because IPv6 packets bypass the IPsec encryption layer during encapsulation using Geneve or VXLAN. Single-stack IPv4 or IPv6 clusters are not affected.

Recommendations Upgrade to Antrea version 2.4.5 or later. Upgrade to Antrea version 2.5.2 or later. Upgrade to Antrea version 2.6.0 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2026-34992

GHSA-QCMW-8MM4-4P28

Affected Products

Antreas

References · 10

• https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07 · Patch
• https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28 · Vendor Advisory
• https://github.com/antrea-io/antrea/pull/7757 · Patch
• https://github.com/antrea-io/antrea/pull/7759 · Patch
• https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md · Patch
• https://osv.dev/vulnerability/GHSA-qcmw-8mm4-4p28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34992 · Security Note
• https://github.com/antrea-io/antrea · Note
• https://t.me/cveNotify/161168 · Telegram Post
• https://twitter.com/CVEnew/status/2041223972428116250 · Twitter Post