Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97 Patch
- https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5 · ciliumNVD modified 2026-10-19 13:10
Affected (CPE criteria) 1
cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*
References 5
- https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97 Patch
- https://github.com/cilium/cilium/releases/tag/v1.16.17 Release Notes
- https://github.com/cilium/cilium/releases/tag/v1.17.10 Release Notes
- https://github.com/cilium/cilium/releases/tag/v1.18.4 Release Notes
- https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm Patch, Vendor Advisory