Database/Container, Kubernetes & orchestration
Cilium: IPsec-eligible traffic matching L7 policy is sent unencrypted
CVSS 6.1CVE-2024-28249Container, Kubernetes & orchestrationcurated
Impact
IPsec-eligible traffic matching L7 policy is sent unencrypted
Who can reach it
Anyone on the underlay network
What to do
Rolling Cilium upgrade
References
Related entries
- Cilium: WireGuard-eligible traffic matching L7 policy is sent unencrypted between nodesCVE-2024-28250 · CiliumMedium
- Cilium: With native routing plus WireGuard node encryption, traffic from pods on other nodes is wrongly permittedCVE-2026-26963 · CiliumMedium
- Cilium: A namespaced HTTPRoute can mirror another tenant's HTTP trafficCVE-2026-56742 · CiliumMedium
- Cilium: L3 port-range plus L7 allow combination results in over-permissive policyCVE-2024-52529 · CiliumMedium
- Cilium: Ingress NetworkPolicies not enforced for pod traffic to L7 servicesCVE-2026-33726 · CiliumMedium
- Cilium: CIDR ipBlock rules without selectors generate a wildcard, over-permitting trafficCVE-2026-56743 · CiliumMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.