Skip to content
Fencer Vulns
medium 6.5

CVE-2025-23047 json

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

published 2025-01-22 21 mo ago modified 2026-09-10 1 mo ago also BIT-cilium-2025-23047 , BIT-cilium-operator-2025-23047 , BIT-hubble-relay-2025-23047 , EUVD-2025-0166 , GHSA-h78m-j95m-5356 , GO-2025-3416

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Patch / fix

  • go github.com/cilium/cilium 1.14.19, 1.15.13, 1.16.6
  • bitnami cilium 1.16.5
  • bitnami cilium-operator 1.16.5
  • bitnami hubble-relay 1.16.5
  • cilium cilium 1.14.18, 1.15.12, 1.16.5
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250128T150132-150000.1.29.1

suse advisories SUSE-SU-2025:0297-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250128T150132-1.1

opensuse advisories openSUSE-SU-2025:14710-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/cilium/cilium
>=1.14.0, <1.14.19
>=1.15.0, <1.15.13
>=1.16.0, <1.16.6
1.14.19
1.15.13
1.16.6
bitnami cilium
>=1.14.0, <1.16.5
1.16.5
bitnami cilium-operator
>=1.15.4, <1.16.5
1.16.5
bitnami hubble-relay
>=1.14.0, <1.16.5
1.16.5

Affected products

  • cilium cilium

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.