Vulnerability in Cilium
CVE-2025-64715
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (5.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 5.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Cilium — versions < 1.16.17, >= 1.17.0, < 1.17.10, >= 1.18.0, < 1.18.4
Weakness classification (CWE)
References
- github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm (Patch, Vendor Advisory)
- github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97 (Patch)
- github.com/cilium/cilium/releases/tag/v1.16.17 (Release Notes)
- github.com/cilium/cilium/releases/tag/v1.17.10 (Release Notes)
- github.com/cilium/cilium/releases/tag/v1.18.4 (Release Notes)
Frequently asked questions
- What is CVE-2025-64715?
- CVE-2025-64715 is a medium-severity vulnerability in Cilium, classified under Improper Access Control. CVSS score: 4.0/10. Published 2025-11-29.
- How severe is CVE-2025-64715?
- Medium severity. CVSS v3 base score is 4.0 out of 10.