← Vulnerability feed

Vulnerability record · CVE-2026-34992 · published 6 April 2026

CVE-2026-34992: Linuxfoundation antrea missing encryption vulnerability

Linuxfoundation · Antrea

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2.

7.1 CVSS 4.0 High EPSS 0.21% · top 89.7% CWE-311 · Missing encryption
7.1CVSS 4.0 base score
0.21%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2.

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md PatchProduct
https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07 Patch
https://github.com/antrea-io/antrea/pull/7757 Issue TrackingPatch
https://github.com/antrea-io/antrea/pull/7759 Issue TrackingPatch
https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28 PatchVendor Advisory

Track CVE-2026-34992 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.0CVE-2026-25804Linuxfoundation antrea improper authentication vulnerabilityAntrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assi…EPSS 0.59%7.5CVE-2026-34486Apache Tomcat EncryptInterceptor bypass exposes sensitive dataApache Tomcat contains a missing encryption of sensitive data flaw: the fix for CVE-2026-29146 can be bypassed, allowing the EncryptInterceptor to be…KEVEPSS 6.6%analysed

Source: NIST National Vulnerability Database (record CVE-2026-34992), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.