{"id":"CVE-2023-30851","aliases":["BIT-cilium-2023-30851","BIT-cilium-operator-2023-30851","BIT-cilium-proxy-2023-30851","BIT-hubble-2023-30851","BIT-hubble-relay-2023-30851","BIT-hubble-ui-2023-30851","BIT-hubble-ui-backend-2023-30851","EUVD-2023-1449","GHSA-2h44-x2wx-49f4","GO-2023-1785"],"status":"published","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00655,"percentile":0.51836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2023-05-22T20:33:15Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Go","package":"github.com/cilium/cilium","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"cilium","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"cilium-operator","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"cilium-proxy","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hubble","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hubble-relay","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hubble-ui","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hubble-ui-backend","fixed_in":["1.11.16","1.12.9","1.13.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cilium-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cilium-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hubble","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hubble-relay","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hubble-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hubble-ui-backend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.16"},{"introduced":"1.12.0"},{"fixed":"1.12.9"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]}],"products":[{"vendor":"cilium","product":"cilium"}],"references":[{"url":"https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/cilium/cilium/releases/tag/v1.11.16","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://github.com/cilium/cilium/releases/tag/v1.12.9","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://github.com/cilium/cilium/releases/tag/v1.13.2","tags":["x_refsource_MISC","x_transferred","Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30851","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2h44-x2wx-49f4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30851.json","tags":["advisory"]},{"url":"https://github.com/cilium/cilium","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30851","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2023-05-25T17:47:51.095Z","modified":"2025-01-16T19:15:24.959Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-1449","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2023-05-25T17:47:51Z","modified":"2025-01-16T19:15:24Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:04:18.077485Z"}],"ghsa":[{"id":"GHSA-2h44-x2wx-49f4","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"### Impact\n\nThis issue only impacts users who:\n\n- Have a HTTP policy that applies to multiple `toEndpoints` AND\n- Have an allow-all rule in place that affects only one of those endpoints\n\nIn such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.\n\n### Patches\n\nThis issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.\n\n### Workarounds\n\nRewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:\n\n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```\n\nIt should be rewritten to:\n \n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```     \n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.\n","status":"published","published":"2023-05-22T20:33:15Z","modified":"2023-11-07T05:05:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2023-30851","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2023-05-25T18:15:10.24Z","modified":"2026-06-17T05:55:46.38Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-30851","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2023-05-25T17:47:51.095Z","modified":"2026-10-28T02:31:09.150770992Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-2h44-x2wx-49f4","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"### Impact\n\nThis issue only impacts users who:\n\n- Have a HTTP policy that applies to multiple `toEndpoints` AND\n- Have an allow-all rule in place that affects only one of those endpoints\n\nIn such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.\n\n### Patches\n\nThis issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.\n\n### Workarounds\n\nRewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:\n\n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```\n\nIt should be rewritten to:\n \n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```     \n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.\n","status":"published","published":"2023-05-22T20:33:15Z","modified":"2026-09-10T03:49:54.485621303Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"BIT-cilium-2023-30851","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-05-15T12:07:32.074Z","modified":"2026-09-08T08:45:17.407119672Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-cilium-operator-2023-30851","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-05-15T12:07:22.476Z","modified":"2026-09-08T08:45:52.830377483Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-cilium-proxy-2023-30851","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-07-01T11:12:50.5Z","modified":"2024-08-20T20:58:42.419899Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-hubble-2023-30851","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-06-04T09:44:47.605Z","modified":"2024-08-20T20:58:42.419899Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hubble-relay-2023-30851","title":"Potential HTTP policy bypass when using header rules in Cilium","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-05-24T19:22:48.082Z","modified":"2026-09-08T08:48:23.049255071Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hubble-ui-2023-30851","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-07-01T11:17:50.594Z","modified":"2024-08-20T20:58:42.419899Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hubble-ui-backend-2023-30851","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.","status":"published","published":"2024-07-01T11:17:52.6Z","modified":"2024-08-20T20:58:42.419899Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2023-1785","title":"Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium","description":"Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium","status":"published","published":"2024-08-20T20:31:32Z","modified":"2026-02-04T03:17:06.433288Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}