CyberRota Analysis
AI-GeneratedCilium versions prior to 1.17.14, 1.18.8, and 1.19.2 are vulnerable due to the creation of a world-accessible admin.sock by the Envoy instance when L7 functionality is enabled. This flaw allows local attackers to access sensitive Envoy admin endpoints, potentially exposing TLS secrets, disrupting cluster traffic, or terminating the Envoy service. Organizations using Cilium for networking and security should prioritize upgrading to the patched versions to mitigate these critical risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)