Protection mechanism failure in Cilium - CVE-2025-64715
Published: November 28, 2025
Vulnerability identifier: #VU118837
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-64715
CWE-ID: CWE-693
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Cilium
Affected software:
Cilium
Cilium
Detailed vulnerability description
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to an error in CiliumNetworkPolicy implementation. If the egress.toGroups.aws.securityGroupsIds references AWS security group IDs that do not exist or are not attached to any network interface, the toCIDRset section of the derived policy is not generated. As a result the outbound traffic is allowed to more destinations than originally intended.
How to mitigate CVE-2025-64715
Install updates from vendor's website.