Every CVE Search/ Get API key

CVE-2025-23047

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

6.5 MediumFix available

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.49%Up 0.4 points since Jan 23, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
CVE-2025-23047
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2025-0166 6.5

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
EUVD-2025-0166
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-h78m-j95m-5356 6.5

Cilium has an information leakage via insecure default Hubble UI CORS header

Impact

For users who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart, an insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page.

Patches

This issue was patched in https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d

This issue affects:

  • Cilium between v1.14.0 and v1.14.18 inclusive
  • Cilium between v1.15.0 and v1.15.12 inclusive
  • Cilium between v1.16.0 and v1.16.5 inclusive

This issue is patched in:

  • Cilium v1.14.19
  • Cilium v1.15.13
  • Cilium v1.16.6

Workarounds

Users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @ciffelia for reporting this issue and to @geakstr for the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

Record
GHSA-h78m-j95m-5356
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 6.5

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
CVE-2025-23047
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 6.5

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
CVE-2025-23047
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-h78m-j95m-5356 6.5

Cilium has an information leakage via insecure default Hubble UI CORS header

Impact

For users who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart, an insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page.

Patches

This issue was patched in https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d

This issue affects:

  • Cilium between v1.14.0 and v1.14.18 inclusive
  • Cilium between v1.15.0 and v1.15.12 inclusive
  • Cilium between v1.16.0 and v1.16.5 inclusive

This issue is patched in:

  • Cilium v1.14.19
  • Cilium v1.15.13
  • Cilium v1.16.6

Workarounds

Users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @ciffelia for reporting this issue and to @geakstr for the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

Record
GHSA-h78m-j95m-5356
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
Show 6 moreShow less
OSVBIT-cilium-2025-23047 No score

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
BIT-cilium-2025-23047
Updated
2026-11-02
OSVBIT-cilium-operator-2025-23047 No score

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
BIT-cilium-operator-2025-23047
Updated
2026-11-02
OSVBIT-hubble-relay-2025-23047 No score

Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.

Record
BIT-hubble-relay-2025-23047
Updated
2026-11-02
OSVGO-2025-3416 No score

Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

Record
GO-2025-3416
Updated
2026-11-02
OSVopenSUSE-SU-2025:14710-1 No score

govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14710-1
Updated
2026-11-02
OSVSUSE-SU-2025:0297-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
    • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
    • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
    • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
    • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
    • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
    • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
    • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
    • GO-2025-3422 CVE-2025-24354

  • Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3372 CVE-2024-45339
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865

  • Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
    • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
    • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
    • GO-2025-3396 CVE-2024-52594
    • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
    • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
    • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
    • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
    • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
    • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

  • Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
    • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
    • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
    • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
    • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

  • Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
    • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
    • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
    • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79
Record
SUSE-SU-2025:0297-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cilium/cilium
Go
 1.14.0 up to 1.14.19
1.14.19
github.com/cilium/cilium
Go
 1.15.0 up to 1.15.13
1.15.13
github.com/cilium/cilium
Go
 1.16.0 up to 1.16.6
1.16.6
cilium
Bitnami
 1.14.0 up to 1.16.5
1.16.5
cilium-operator
Bitnami
 1.15.4 up to 1.16.5
1.16.5
hubble-relay
Bitnami
 1.14.0 up to 1.16.5
1.16.5
github.com/cilium/cilium
Go
 1.14.0 up to 1.14.19, 1.15.0 up to 1.15.13, 1.16.0 up to 1.16.6
1.14.191.15.131.16.6
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.0.20250128T150132-1.1
0.0.20250128T150132-1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23047 is a medium vulnerability (CVSS 6.5) in Cilium, published January 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in github.com/cilium/cilium 1.14.19.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open