Auth bypass in Cilium

CVE-2025-30162

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 3.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (11.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 11.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-30162: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Cilium — versions >= 1.16.0, < 1.16.8, >= 1.17.0, < 1.17.2, >= 1.15.0, < 1.15.15

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-30162?
CVE-2025-30162 is a low-severity vulnerability in Cilium, classified under Incorrect Authorization. CVSS score: 3.2/10. Published 2025-03-24.
How severe is CVE-2025-30162?
Low severity. CVSS v3 base score is 3.2 out of 10.