← Vulnerability feed

Vulnerability record · CVE-2024-47825 · published 21 October 2024

CVE-2024-47825: Cilium incorrect default permissions vulnerability

Cilium · Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.

8.7 CVSS 3.1 High EPSS 0.40% · top 68.7% CWE-276 · Incorrect default permissions
8.7CVSS 3.1 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cilium/cilium/security/advisories/GHSA-3wwx-63fv-pfq6 Vendor Advisory

Track CVE-2024-47825 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-27595Cilium vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a shor…EPSS 0.73%9.0CVE-2023-39347Cilium insufficient verification of data authenticity vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can caus…EPSS 0.57%8.9CVE-2026-56742Cilium missing authorization vulnerabilityCilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users wi…EPSS 0.17%8.8CVE-2026-49445Cilium incorrect permission assignment vulnerabilityCilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embe…EPSS 0.17%8.2CVE-2022-29178Cilium incorrect default permissions vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versi…EPSS 0.28%8.2CVE-2022-29179Cilium improper privilege management vulnerabilityCilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9…EPSS 0.36%8.1CVE-2023-41333Cilium missing authentication for critical function vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNet…EPSS 0.48%7.3CVE-2023-27594Cilium improper authorization vulnerabilityCilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under speci…EPSS 0.55%

Source: NIST National Vulnerability Database (record CVE-2024-47825), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.