{"id":"CVE-2025-30162","aliases":["BIT-cilium-2025-30162","BIT-cilium-operator-2025-30162","BIT-hubble-relay-2025-30162","EUVD-2025-7997","GHSA-24qp-4xx8-3jvj","GO-2025-3560","openSUSE-SU-2025:14937-1"],"status":"published","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00224,"percentile":0.13154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-03-24T18:44:07Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"Go","package":"github.com/cilium/cilium","fixed_in":["1.16.8","1.17.2","1.15.15"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"cilium","fixed_in":["1.17.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"cilium-operator","fixed_in":["1.17.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hubble-relay","fixed_in":["1.17.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.15"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cilium-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hubble-relay","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cilium/cilium","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.15"},{"introduced":"1.16.0"},{"fixed":"1.16.8"},{"introduced":"1.17.0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250327T184518-1.1"}]}],"bundled":30}],"products":[{"vendor":"cilium","product":"cilium"}],"references":[{"url":"https://github.com/cilium/cilium/security/advisories/GHSA-24qp-4xx8-3jvj","tags":["x_refsource_CONFIRM","Mitigation","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/cilium/proxy/pull/1172","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://docs.cilium.io/en/stable/network/lb-ipam","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30162","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-24qp-4xx8-3jvj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30162.json","tags":["advisory"]},{"url":"https://github.com/cilium/cilium","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-30162","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-24T18:44:07.927Z","modified":"2025-03-24T19:30:18.385Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-7997","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-24T18:44:07Z","modified":"2025-03-24T19:30:18Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:54.153762Z"}],"ghsa":[{"id":"GHSA-24qp-4xx8-3jvj","title":"Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"### Impact\n\nFor Cilium users who:\n- Use Gateway API for Ingress for some services **AND**\n- Use [LB-IPAM](https://docs.cilium.io/en/stable/network/lb-ipam/) or BGP for LB Service implementation **AND**\n- Use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces\n\nEgress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed.\n\nLoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue.\n\n### Patches\n\nThis issue was fixed by https://github.com/cilium/proxy/pull/1172.\n\nThis issue affects:\n\n- Cilium v1.15 between v1.15.0 and v1.15.14 inclusive\n- Cilium v1.16 between v1.16.0 and v1.16.7 inclusive\n- Cilium v1.17 between v1.17.0 and v1.17.1 inclusive\n\nThis issue is fixed in:\n\n- Cilium v1.15.15\n- Cilium v1.16.8\n- Cilium v1.17.2\n\n### Workarounds\n\nA Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. An outline of such a policy is provided below:\n\n```\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"workaround\"\nspec:\n  endpointSelector:\n    matchExpressions:\n    - key: reserved:ingress\n      operator: Exists\n  ingress:\n  - fromEntities:\n    - world\n```\n\n- The policy opens up connectivity from all locations outside the cluster into the Cilium Ingress Gateway.\n- The policy establishes a default deny for all other traffic towards the Cilium Ingress Gateway, including all in-cluster sources.\n- It is possible to tailor the policy to more narrowly allow inbound traffic while creating a default deny posture for traffic between namespaces. Users should edit the policy to bring it in line with the security requirements particular to their environments.\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of the Isovalent team to prepare these mitigations. Special thanks to @jrajahalme for the fix.\n\n### For more information\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.","status":"published","published":"2025-03-24T19:05:04Z","modified":"2025-03-24T21:47:17Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2025-30162","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-24T19:15:52.767Z","modified":"2026-06-17T09:08:16.51Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-30162","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-24T18:44:07.927Z","modified":"2026-10-28T02:31:10.679333031Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-24qp-4xx8-3jvj","title":"Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"### Impact\n\nFor Cilium users who:\n- Use Gateway API for Ingress for some services **AND**\n- Use [LB-IPAM](https://docs.cilium.io/en/stable/network/lb-ipam/) or BGP for LB Service implementation **AND**\n- Use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces\n\nEgress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed.\n\nLoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue.\n\n### Patches\n\nThis issue was fixed by https://github.com/cilium/proxy/pull/1172.\n\nThis issue affects:\n\n- Cilium v1.15 between v1.15.0 and v1.15.14 inclusive\n- Cilium v1.16 between v1.16.0 and v1.16.7 inclusive\n- Cilium v1.17 between v1.17.0 and v1.17.1 inclusive\n\nThis issue is fixed in:\n\n- Cilium v1.15.15\n- Cilium v1.16.8\n- Cilium v1.17.2\n\n### Workarounds\n\nA Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. An outline of such a policy is provided below:\n\n```\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"workaround\"\nspec:\n  endpointSelector:\n    matchExpressions:\n    - key: reserved:ingress\n      operator: Exists\n  ingress:\n  - fromEntities:\n    - world\n```\n\n- The policy opens up connectivity from all locations outside the cluster into the Cilium Ingress Gateway.\n- The policy establishes a default deny for all other traffic towards the Cilium Ingress Gateway, including all in-cluster sources.\n- It is possible to tailor the policy to more narrowly allow inbound traffic while creating a default deny posture for traffic between namespaces. Users should edit the policy to bring it in line with the security requirements particular to their environments.\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of the Isovalent team to prepare these mitigations. Special thanks to @jrajahalme for the fix.\n\n### For more information\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.","status":"published","published":"2025-03-24T19:05:04Z","modified":"2026-09-10T03:50:06.165871995Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"BIT-cilium-2025-30162","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-26T07:08:03.178Z","modified":"2026-09-08T08:45:56.591865487Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-cilium-operator-2025-30162","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-26T07:07:58.869Z","modified":"2026-09-08T08:45:51.824772327Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-hubble-relay-2025-30162","title":"East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.","status":"published","published":"2025-03-26T07:14:51.053Z","modified":"2026-09-08T08:48:23.035130163Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3560","title":"Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium","description":"Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium","status":"published","published":"2025-03-25T19:38:11Z","modified":"2026-02-04T04:35:35.741655Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T02:21:10.797539Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}