CVE-2025-64715
Medium · 4.0CVSS
4.0
EPSS
0.2%
Published
Nov 29, 2025
CISA due date
—
The record
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | Ciliumgithub.com/cilium/cilium | 1.17.0 | 1.17.10 |
| Go | github.com/cilium/cilium | 0 | 1.16.17 |
| Go | github.com/cilium/cilium | 1.18.0 | 1.18.4 |
| Bitnami | cilium | 0 | 1.16.17 |
| Bitnami | cilium-operator | 0 | 1.16.17 |
| Bitnami | hubble-relay | 0 | 1.16.17 |
| Chainguard | cilium-1.14-container-init | 0 | 1.14.19-r35 |
| Chainguard | cilium-1.14-container-init-compat | 0 | 1.14.19-r35 |
| Chainguard | cilium-1.14-iptables | 0 | 1.14.19-r36 |
| Chainguard | cilium-1.15-container-init | 0 | 1.15.19-r4 |
| Chainguard | cilium-1.15-container-init-compat | 0 | 1.15.19-r4 |
| Chainguard | cilium-1.15-iptables | 0 | 1.15.19-r4 |
| Chainguard | cilium-fips-1.14-compat | 0 | 1.14.19-r58 |
| Chainguard | cilium-fips-1.14-container-init | 0 | 1.14.19-r58 |
| Chainguard | cilium-fips-1.14-container-init-compat | 0 | 1.14.19-r58 |
| Chainguard | cilium-fips-1.14-iptables | 0 | 1.14.19-r58 |
| Chainguard | cilium-fips-1.15-container-init | 0 | 1.15.19-r9 |
| Chainguard | cilium-fips-1.15-container-init-compat | 0 | 1.15.19-r10 |
| Chainguard | hubble-ui | 0 | 0.13.3-r3 |
| Chainguard | hubble-ui-backend | 0 | 0.13.3-r3 |
| Chainguard | hubble-ui-backend-fips | 0 | 0.13.3-r3 |
| Wolfi | cilium-1.14-container-init | 0 | 1.14.19-r35 |
| Wolfi | cilium-1.14-container-init-compat | 0 | 1.14.19-r35 |
| Wolfi | cilium-1.14-iptables | 0 | 1.14.19-r36 |
| Wolfi | cilium-1.15-container-init | 0 | 1.15.19-r4 |
| Wolfi | cilium-1.15-container-init-compat | 0 | 1.15.19-r4 |
| Wolfi | cilium-1.15-iptables | 0 | 1.15.19-r4 |
| Wolfi | hubble-ui | 0 | 0.13.3-r3 |
| Wolfi | hubble-ui-backend | 0 | 0.13.3-r3 |
| go | github.com/cilium/cilium | 1.18.0 | 1.18.4 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- GO-2026-4522 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node… Also affects github.com/cilium/cilium
- CVE-2026-26963 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Also affects github.com/cilium/cilium
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects cilium-1.14-container-init
- CVE-2023-46565 Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b… Also affects cilium-1.14-container-init
- CVE-2025-47913 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and… Also affects cilium-fips-1.15-container-init
- CVE-2026-33726 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Also affects hubble-ui-backend
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb