Cilium Vulnerability: Sensitive Information Disclosure and Cluster Disruption
Cilium is under investigation for a vulnerability that may allow sensitive information disclosure and cluster disruption via local Envoy admin socket access when L7 functionality is enabled.
What happened
An early warning has been issued regarding a vulnerability in Cilium that appears to enable sensitive information disclosure and cluster disruption. The issue arises when L7 functionality is enabled, creating a world-accessible socket that local attackers can use to access Envoy admin endpoints. To assess your exposure, check if your Cilium deployment has L7 functionality enabled and if the version is within the affected range: >=1.17.14,<1.17.14 || >=1.18.0,<1.18.7 || >=1.19.0,<1.19.1. It is recommended to upgrade to Cilium v1.17.14, v1.18.8, or v1.19.2 to mitigate this vulnerability. For more details, consult the primary sources.
How 0Day mitigates this
cilium is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.