4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64715

CVE-2025-64715: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Impact

CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended.

Patches

This issue has been patched in:

Cilium v1.18.4
Cilium v1.17.10
Cilium v1.16.17

This issue affects:

Cilium v1.18 between v1.18.0 and v1.18.3 inclusive
Cilium v1.17 between v1.17.0 and v1.17.9 inclusive
Cilium v1.16.16 and below

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @SeanEmac for reporting this issue and to @fristonio for the patch.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64715

CVE-2025-64715:

4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cilium/cilium	go	>= 1.18.0, < 1.18.4	1.18.4
Ciliumgithub.com/cilium/cilium	go	>= 1.17.0, < 1.17.10	1.17.10
github.com/cilium/cilium	go	< 1.16.17	1.16.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the serialization of Cilium network policy rules. Specifically, the ToCIDRSet and FromCIDRSet fields in EgressCommonRule and IngressCommonRule structs were tagged with json:"omitempty". When a policy's toGroups or fromGroups referred to a non-existent entity (like an AWS security group), it would resolve to an empty set of IP addresses. This resulted in an empty slice for the ToCIDRSet or FromCIDRSet fields.

Due to the omitempty tag, this empty slice was omitted from the JSON output when the policy was serialized. The absence of this field was interpreted by Cilium's policy enforcement engine as having no L3 restrictions, which defaults to an "allow all" behavior. The intended behavior for an empty set of IPs should be "deny all".

The CreateDerivative methods for EgressRule, EgressDenyRule, IngressRule, and IngressDenyRule are the functions responsible for constructing these vulnerable policy rule objects that are then incorrectly serialized.

The patch fixes this by changing the JSON tag from omitempty to omitzero. The omitzero tag ensures that an empty slice is serialized into the JSON (e.g., "toCIDRSet":[]), which is correctly interpreted by the policy engine as "deny all" for L3 traffic, thus enforcing the intended policy.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64715: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Impact

Patches

This issue affects:

Workarounds

Acknowledgements

For more information

CVE-2025-64715:

4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2025-64715: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Impact

Patches

This issue affects:

Workarounds

Acknowledgements

For more information

4

4

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI