CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
AI Score
Confidence
Low
EPSS
Percentile
48.0%
Cilium is vulnerable to HTTP Policy Bypass. The vulnerability is due to inconsistencies when applying HTTP policies. This inconsistency allows HTTP traffic to be incorrectly and intermittently forwarded when it should be dropped, potentially allowing unauthorized access or information disclosure.
docs.cilium.io/en/stable/security/policy/language/#http
github.com/advisories/GHSA-68mj-9pjq-mc85
github.com/cilium/cilium/commit/1195e33f4cea7843508c57772e7288dcfaef9a88
github.com/cilium/cilium/releases/tag/v1.13.13
github.com/cilium/cilium/releases/tag/v1.14.8
github.com/cilium/cilium/releases/tag/v1.15.2
github.com/cilium/cilium/security/advisories/GHSA-68mj-9pjq-mc85