CVE-2025-32793CWE-319

Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Medium · published April 21, 2025

CVSS v3.1
4.0
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-04-21T15:34Z
EPSS history
Timeline
  • 21 APR 15:34Z
    Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
    cvelistv5