CVE-2023-27595 json
Cilium eBPF filters may be temporarily removed during agent restart
published 2023-03-17 3 y ago modified 2026-09-10 1 mo ago also BIT-cilium-2023-27595 , BIT-cilium-operator-2023-27595 , BIT-cilium-proxy-2023-27595 , BIT-hubble-2023-27595 , BIT-hubble-relay-2023-27595 , BIT-hubble-ui-2023-27595 , BIT-hubble-ui-backend-2023-27595 , EUVD-2023-1092 , GHSA-r5x6-w42p-jhpp , GO-2023-1644
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a short period when Cilium eBPF programs are not attached to the host. During this period, the host does not implement any of Cilium's featureset. This can cause disruption to newly established connections during this period due to the lack of Load Balancing, or can cause Network Policy bypass due to the lack of Network Policy enforcement during the window. This vulnerability impacts any Cilium-managed endpoints on the node (such as Kubernetes Pods), as well as the host network namespace (including Host Firewall). This vulnerability is fixed in Cilium 1.13.1 or later. Cilium releases 1.12.x, 1.11.x, and earlier are not affected. There are no known workarounds.
Patch / fix
- go github.com/cilium/cilium 1.13.1
- bitnami cilium 1.13.1
- bitnami cilium-operator 1.13.1
- bitnami hubble-relay 1.13.1
- github.com/cilium/cilium#24336 pull request
- github.com/cilium/cilium/releases/tag/v1.13.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/cilium/cilium | >=1.13.0, <1.13.1 |
1.13.1 |
| bitnami | cilium | >=1.13.0, <1.13.1 |
1.13.1 |
| bitnami | cilium-operator | >=1.13.0, <1.13.1 |
1.13.1 |
| bitnami | cilium-proxy | >=1.13.0, <=1.13.0 |
no fix listed |
| bitnami | hubble | >=1.13.0, <=1.13.0 |
no fix listed |
| bitnami | hubble-relay | >=1.13.0, <1.13.1 |
1.13.1 |
| bitnami | hubble-ui | >=1.13.0, <=1.13.0 |
no fix listed |
| bitnami | hubble-ui-backend | >=1.13.0, <=1.13.0 |
no fix listed |
Affected products
- cilium cilium
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
github.com
/cilium/cilium/pull/24336
web, third-party-advisory, advisory, patch
-
github.com
/cilium/cilium/security/advisories/GHSA-r5x6-w42p-jhpp
web, third-party-advisory, advisory
-
github.com
/cilium/cilium/releases/tag/v1.13.1
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-27595
advisory, web
-
github.com
/cilium/cilium
package
Sources
- CVE List CVE-2023-27595
- GitHub Advisory GHSA-r5x6-w42p-jhpp
- NVD CVE-2023-27595
- OSV BIT-cilium-2023-27595
- OSV BIT-cilium-operator-2023-27595
- OSV BIT-cilium-proxy-2023-27595
- OSV BIT-hubble-2023-27595
- OSV BIT-hubble-relay-2023-27595
- OSV BIT-hubble-ui-2023-27595
- OSV BIT-hubble-ui-backend-2023-27595
- OSV GO-2023-1644
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.