CVE-2025-30162

Отчет

The vulnerability is not present in a default installation. It requires a specific and complex combination of configurations to be exploitable. Specifically, the environment must be using the Gateway API for Ingress, combined with LB-IPAM or BGP for LoadBalancer service implementation, and specific network policies must be in place. This "perfect storm" of configuration prerequisites makes a successful attack significantly less likely in the wild. Hence, Red Hat rated this vulnerability as Low impact with AC:H.

Меры по смягчению последствий

A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. An outline of such a policy is provided below: apiVersion: "cilium.io/v2" kind: CiliumClusterwideNetworkPolicy metadata: name: "workaround" spec: endpointSelector: matchExpressions:

• key: reserved:ingress operator: Exists ingress:
• fromEntities:
• world
• The policy opens up connectivity from all locations outside the cluster into the Cilium Ingress Gateway.
• The policy establishes a default deny for all other traffic towards the Cilium Ingress Gateway, including all in-cluster sources.
• It is possible to tailor the policy to more narrowly allow inbound traffic while creating a default deny posture for traffic between namespaces. Users should edit the policy to bring it in line with the security requirements particular to their environments.