Affected by GO-2025-3560 and 7 other vulnerabilities

GO-2025-3560: Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium

GO-2025-3561: Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium

GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium

groups

package

v1.16.6 Latest Latest Go to latest Published: Jan 21, 2025 License: Apache-2.0 Imports: 14 Imported by: 5

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Index ¶

func AddDerivativeCCNPIfNeeded(clientset client.Clientset, cnp *cilium_v2.CiliumNetworkPolicy) bool
func AddDerivativeCNPIfNeeded(clientset client.Clientset, cnp *cilium_v2.CiliumNetworkPolicy) bool
func DeleteDerivativeCCNP(ctx context.Context, clientset client.Clientset, ...) error
func DeleteDerivativeCNP(ctx context.Context, clientset client.Clientset, ...) error
func DeleteDerivativeFromCache(cnp *cilium_v2.CiliumNetworkPolicy)
func UpdateCNPInformation(clientset client.Clientset)
func UpdateDerivativeCCNPIfNeeded(clientset client.Clientset, newCCNP *cilium_v2.CiliumNetworkPolicy, ...) bool
func UpdateDerivativeCNPIfNeeded(clientset client.Clientset, newCNP *cilium_v2.CiliumNetworkPolicy, ...) bool

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func AddDerivativeCCNPIfNeeded ¶

func AddDerivativeCCNPIfNeeded(clientset client.Clientset, cnp *cilium_v2.CiliumNetworkPolicy) bool

AddDerivativeCCNPIfNeeded will create a new CCNP if the given NetworkPolicy has any rules that need to create a new derivative policy. It returns a boolean, true in case that all actions are correct, false if something fails.

func AddDerivativeCNPIfNeeded ¶

func AddDerivativeCNPIfNeeded(clientset client.Clientset, cnp *cilium_v2.CiliumNetworkPolicy) bool

AddDerivativeCNPIfNeeded will create a new CNP if the given CNP has any rules that need to create a new derivative policy. It returns a boolean, true in case that all actions are correct, false if something fails.