What’s Vulnerable › Vulnerabilities

CVE-2023-30851: Potential HTTP policy bypass when using header rules in Cilium

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-25 · updated 2026-06-17
• Weakness: CWE-693

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Affected products

• cilium: before 1.11.16; from 1.12.0 before 1.12.9; from 1.13.0 before 1.13.2 — fixed in 1.11.16, 1.12.9, 1.13.2

How to fix

Upgrade to a fixed version: cilium 1.11.16, 1.12.9, 1.13.2. Check the vendor advisory for mitigations.

References

• https://github.com/cilium/cilium/releases/tag/v1.11.16
• https://github.com/cilium/cilium/releases/tag/v1.12.9
• https://github.com/cilium/cilium/releases/tag/v1.13.2
• https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4
• https://github.com/cilium/cilium/releases/tag/v1.11.16
• https://github.com/cilium/cilium/releases/tag/v1.12.9
• https://github.com/cilium/cilium/releases/tag/v1.13.2
• https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4

Get alerted when CVE-2023-30851 or the next vulnerability affects your stack