CVE-2025-32793
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
CVE-2025-32793- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
EUVDEUVD-2025-12230
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
EUVD-2025-12230- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5vxx-c285-pcq4
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Impact
When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.
Patches
This issue has been patched in https://github.com/cilium/cilium/pull/38592.
This issue affects:
- Cilium v1.15 between v1.15.0 and v1.15.15 inclusive
- Cilium v1.16 between v1.16.0 and v1.16.8 inclusive
- Cilium v1.17 between v1.17.0 and v1.17.2 inclusive
This issue is fixed in:
- Cilium v1.15.16
- Cilium v1.16.9
- Cilium v1.17.3
Workarounds
There is no workaround to this issue.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch.
For more information
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
- Record
GHSA-5vxx-c285-pcq4- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-319, CWE-362
- Updated
- 2026-11-02
NVD
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
CVE-2025-32793- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-319, CWE-362
- Updated
- 2026-11-02
OSV
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
CVE-2025-32793- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVGHSA-5vxx-c285-pcq4
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Impact
When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.
Patches
This issue has been patched in https://github.com/cilium/cilium/pull/38592.
This issue affects:
- Cilium v1.15 between v1.15.0 and v1.15.15 inclusive
- Cilium v1.16 between v1.16.0 and v1.16.8 inclusive
- Cilium v1.17 between v1.17.0 and v1.17.2 inclusive
This issue is fixed in:
- Cilium v1.15.16
- Cilium v1.16.9
- Cilium v1.17.3
Workarounds
There is no workaround to this issue.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch.
For more information
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
- Record
GHSA-5vxx-c285-pcq4- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-319, CWE-362
- Updated
- 2026-11-02
Show 5 moreShow less
OSVBIT-cilium-2025-32793 No score
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
BIT-cilium-2025-32793- Updated
- 2026-11-02
OSVBIT-cilium-operator-2025-32793 No score
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
BIT-cilium-operator-2025-32793- Updated
- 2026-11-02
OSVBIT-hubble-relay-2025-32793 No score
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
- Record
BIT-hubble-relay-2025-32793- Updated
- 2026-11-02
OSVGO-2025-3635 No score
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
- Record
GO-2025-3635- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15017-1 No score
govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250422T181640-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15017-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cilium/ciliumGo |
1.13.0 up to 1.15.16 | 1.15.16 |
github.com/cilium/ciliumGo |
1.16.0 up to 1.16.9 | 1.16.9 |
github.com/cilium/ciliumGo |
1.17.0 up to 1.17.3 | 1.17.3 |
ciliumBitnami |
1.13.0 up to 1.17.3 | 1.17.3 |
cilium-operatorBitnami |
1.13.0 up to 1.17.3 | 1.17.3 |
hubble-relayBitnami |
1.13.0 up to 1.17.3 | 1.17.3 |
github.com/cilium/ciliumGo |
1.13.0 up to 1.15.16, 1.16.0 up to 1.16.9, 1.17.0 up to 1.17.3 | 1.15.161.16.91.17.3 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 23 CVEs |
before 0.0.20250422T181640-1.1 | 0.0.20250422T181640-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32793 is a medium vulnerability (CVSS 4.0) in Cilium, published April 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in github.com/cilium/cilium 1.15.16.
References
github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4
nvd.nist.gov/vuln/detail/CVE-2025-32793
Show 25 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7
suse.com/security/cve/CVE-2019-15119