Improper Privilege Management in CiliumGHSA-fmrf-gvjp-5j5g
HIGHGHSA-fmrf-gvjp-5j5g is a high-severity (CVSS 7.5) Improper Privilege Management vulnerability in github.com/cilium/cilium. A fix is available for github.com/cilium/cilium — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-fmrf-gvjp-5j5g.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
github.com/cilium/cilium🐹github.com/cilium/cilium🐹github.com/cilium/ciliumReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
If an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can leverage Cilium's Kubernetes service account to gain access to cluster privileges that are more permissive than what is minimally required to operate Cilium. In affected releases, this service account had access to modify and delete Pod and Node resources.
Patches
The problem has been fixed and is available on versions >=1.9.16, >=1.10.11, >=1.11.5
Workarounds
There are no workarounds available.
Acknowledgements
The Cilium community has worked together with members of Isovalent, Amazon and Palo Alto Networks to prepare these mitigations. Special thanks to Micah Hausler (AWS), Robert Clark (AWS), Yuval Avrahami (Palo Alto Networks), and Shaul Ben Hai (Palo Alto Networks) for their cooperation.
For more information
If you have any questions or comments about this advisory:
Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/cilium/cilium | ≥ 1.11.0&&< 1.11.5 | 1.11.5go get github.com/cilium/cilium@v1.11.5 |
| 🐹Go | github.com/cilium/cilium | ≥ 1.10.0&&< 1.10.11 | 1.10.11go get github.com/cilium/cilium@v1.10.11 |
| 🐹Go | github.com/cilium/cilium | all versions | 1.9.16go get github.com/cilium/cilium@v1.9.16 |
Affected Products
ciliumciliumDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/cilium/cilium, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/cilium/cilium to 1.11.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-fmrf-gvjp-5j5g is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is GHSA-fmrf-gvjp-5j5g in your dependencies?
Find it across Go, including transitive dependencies.