{"id":"GHSA-g8fc-vrcg-8vjg","aliases":["GO-2024-2727"],"status":"published","title":"Constallation has pods exposed to peers in VPC","description":"### Impact\n\nCilium allows outside actors (`world` entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via `LoadBalancer`). A pod that does not authenticate clients and that does not exclude `world` traffic via network policy may leak sensitive data to an attacker _inside the cloud VPC_.\n\n### Patches\n\nThe issue has been patched in [v2.16.3](https://github.com/edgelesssys/constellation/releases/tag/v2.16.3).\n\n### Workarounds\n\nThis network policy excludes all `world` traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).\n\n```yaml\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"from-world-to-role-public\"\nspec:\n  endpointSelector:\n    matchLabels: {}\n    #  role: public\n  ingressDeny:\n    - fromEntities:\n      - world\n```\n\n### References\n\nThe tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-940"],"published":"2024-04-15T18:13:15Z","modified":"2026-03-03T04:51:48Z","fixes":[{"ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","fixed_in":["2.16.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/edgelesssys/constellation/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.3"}]}]}],"references":[{"url":"https://github.com/edgelesssys/constellation/security/advisories/GHSA-g8fc-vrcg-8vjg","tags":["web","advisory"]},{"url":"https://github.com/cilium/cilium/issues/25626","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2727","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g8fc-vrcg-8vjg"},{"url":"https://github.com/edgelesssys/constellation","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g8fc-vrcg-8vjg","title":"Constallation has pods exposed to peers in VPC","description":"### Impact\n\nCilium allows outside actors (`world` entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via `LoadBalancer`). A pod that does not authenticate clients and that does not exclude `world` traffic via network policy may leak sensitive data to an attacker _inside the cloud VPC_.\n\n### Patches\n\nThe issue has been patched in [v2.16.3](https://github.com/edgelesssys/constellation/releases/tag/v2.16.3).\n\n### Workarounds\n\nThis network policy excludes all `world` traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).\n\n```yaml\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"from-world-to-role-public\"\nspec:\n  endpointSelector:\n    matchLabels: {}\n    #  role: public\n  ingressDeny:\n    - fromEntities:\n      - world\n```\n\n### References\n\nThe tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626. \n","status":"published","published":"2024-04-15T18:13:15Z","modified":"2024-06-04T19:35:52Z","cwes":["CWE-940"],"updated_at":"2026-11-02T14:37:53.025064Z"}],"osv":[{"id":"GHSA-g8fc-vrcg-8vjg","title":"Constallation has pods exposed to peers in VPC","description":"### Impact\n\nCilium allows outside actors (`world` entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via `LoadBalancer`). A pod that does not authenticate clients and that does not exclude `world` traffic via network policy may leak sensitive data to an attacker _inside the cloud VPC_.\n\n### Patches\n\nThe issue has been patched in [v2.16.3](https://github.com/edgelesssys/constellation/releases/tag/v2.16.3).\n\n### Workarounds\n\nThis network policy excludes all `world` traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).\n\n```yaml\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"from-world-to-role-public\"\nspec:\n  endpointSelector:\n    matchLabels: {}\n    #  role: public\n  ingressDeny:\n    - fromEntities:\n      - world\n```\n\n### References\n\nThe tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626. \n","status":"published","published":"2024-04-15T18:13:15Z","modified":"2024-06-04T19:35:51Z","cwes":["CWE-940"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GO-2024-2727","title":"Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation","description":"Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-03-03T04:51:48.316805Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}