Affected by GO-2025-4167 and 4 other vulnerabilities

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4522: Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled in github.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

api

package

v1.18.1 Latest Latest Go to latest Published: Aug 13, 2025 License: Apache-2.0 Imports: 18 Imported by: 44

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Overview ¶

Package api provides the Cilium useful helpers for the external API

Index ¶

Constants
Variables
func DisableAPIs(logger *slog.Logger, paths PathSet, ...)
func SetDefaultPermissions(debugLogger func(msg string, args ...any), socketPath string) error
type APIError
- func Error(code int, err error) *APIError
- func New(code int, msg string, args ...any) *APIError
type APIPanicHandler
- func (h *APIPanicHandler) ServeHTTP(wr http.ResponseWriter, req *http.Request)
type AdminDisableHandler
- func NewAdminDisableHandler(logger *slog.Logger, name string) *AdminDisableHandler
- func (a *AdminDisableHandler) ServeHTTP(wr http.ResponseWriter, req *http.Request)
type Endpoint
type PathSet
- func AllowedFlagsToDeniedPaths(spec *loads.Document, allowed []string) (PathSet, error)
- func NewPathSet(spec *loads.Document) PathSet

Constants ¶

View Source

const (
	// CiliumGroupName is the cilium's unix group name.
	CiliumGroupName = "cilium"
	// SocketFileMode is the default file mode for the sockets.
	SocketFileMode os.FileMode = 0660
	// ClientTimeout specifies timeout to be used by clients
	ClientTimeout = 90 * time.Second
)

Variables ¶

View Source

var (
	ErrUnknownWildcard = fmt.Errorf("Unsupported API wildcard")
	ErrUnknownFlag     = fmt.Errorf("Unknown API flag")
)

Functions ¶

func DisableAPIs ¶

func DisableAPIs(logger *slog.Logger, paths PathSet, addMiddleware func(method string, path string, builder middleware.Builder))

DisableAPIs configures the API middleware for all of the paths in the provided PathSet such that those APIs will be administratively disabled at runtime.

func SetDefaultPermissions ¶

func SetDefaultPermissions(debugLogger func(msg string, args ...any), socketPath string) error

SetDefaultPermissions sets the given socket's group to `CiliumGroupName` and mode to `SocketFileMode`.

Types ¶

type APIError ¶

type APIError struct {
	// contains filtered or unexported fields
}

APIError is the error representation for the API.

func Error ¶

func Error(code int, err error) *APIError

Error creates a new API error from the code and error.

func New ¶

func New(code int, msg string, args ...any) *APIError

New creates an API error from the code, msg and extra arguments.

func (*APIError) Error ¶

func (a *APIError) Error() string

Error returns the API error message.

func (*APIError) GetCode ¶ added in v1.15.4

func (a *APIError) GetCode() int

GetCode returns the code for the API Error.

func (*APIError) GetModel ¶

func (a *APIError) GetModel() *models.Error

GetModel returns model error.

func (*APIError) WriteResponse ¶

func (a *APIError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer)

WriteResponse to the client.

type APIPanicHandler ¶

type APIPanicHandler struct {
	Logger *slog.Logger
	Next   http.Handler
}

APIPanicHandler recovers from API panics and logs encountered panics

func (*APIPanicHandler) ServeHTTP ¶

func (h *