What’s Vulnerable › Vulnerabilities

CVE-2025-64715: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-29 · updated 2026-10-19
• Weakness: CWE-284

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.

Affected products

• cilium: before 1.16.17; from 1.17.0 before 1.17.10; from 1.18.0 before 1.18.4 — fixed in 1.16.17, 1.17.10, 1.18.4

How to fix

Upgrade to a fixed version: cilium 1.16.17, 1.17.10, 1.18.4. Check the vendor advisory for mitigations.

References

• https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97
• https://github.com/cilium/cilium/releases/tag/v1.16.17
• https://github.com/cilium/cilium/releases/tag/v1.17.10
• https://github.com/cilium/cilium/releases/tag/v1.18.4
• https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm

Get alerted when CVE-2025-64715 or the next vulnerability affects your stack