Database/Container, Kubernetes & orchestration
Docker Engine overlay driver: firewalld reload silently drops IPsec rules on encrypted overlay networks
Impact
On hosts running firewalld, a firewalld reload or start deletes the iptables rules that enforce IPsec on encrypted overlay networks, and the overlay driver never puts them back. From then on, outgoing VXLAN traffic between containers leaves the node unencrypted, and the node accepts cleartext VXLAN coming in. That exposes inter-container traffic to reading and injection by anyone on the underlay network. dockerd logs nothing about it. The condition lasts until the network's last local endpoint is removed and a new one is added, or until dockerd restarts, and it comes back on every later firewalld event. Operators who use encrypted overlays to separate tenants or workloads across nodes lose that protection without any signal.
Who can reach it
Someone on the network path between Docker nodes (the underlay or host network) can read or inject VXLAN traffic. No authentication is needed. It only matters on hosts that run firewalld and use encrypted overlay networks, and only after a firewalld reload or start has happened.
What to do
Upgrade Docker Engine / Moby to the fixed release listed in GHSA-6jhp-7446-hf7f. The record does not name a fixed version. Until then, restart dockerd after every firewalld reload or start to put the rules back. A dockerd restart stops running containers unless live-restore is enabled, so schedule it per node. Avoiding firewalld reloads on these hosts also stops the condition from coming back.
References
Related entries
- Traefik: mTLS silently disabled when another Ingress shares the host, bypassing client-cert authCVE-2026-119572 · Traefik (Kubernetes Ingress NGINX provider, auth-tls-secret mTLS)High
- Traefik: Service middleware annotation escapes crossProviderNamespaces restrictionsCVE-2026-85594 · Traefik Kubernetes Ingress provider (traefik.ingress.kubernetes.io/service.middlewares annotation)High
- Cilium: A user who can create CiliumNetworkPolicy in one namespace affects traffic cluster-wideCVE-2023-41333 · CiliumMedium
- Docker / moby: Classic builder cache poisoning for images built FROM scratchCVE-2024-24557 · Docker / mobyMedium
- Kyverno: policy Service Call resolves external addresses and ships policy context off-clusterCVE-2025-15613 · Kyverno admission controller (policy apiCall Service Call)Medium
- Kata Containers: A malicious host can circumvent guest protectionsCVE-2025-58354 · Kata ContainersMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.