Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cilium/cilium | go | >= 1.19.0, < 1.19.2 | 1.19.2 |
| github.com/cilium/cilium | go | >= 1.18.0, < 1.18.8 | 1.18.8 |
| github.com/cilium/cilium | go | < 1.17.14 | 1.17.14 |
Miggo AIRoot Cause AnalysisThe security vulnerability arises from a world-accessible Envoy admin socket created by Cilium, which could be exploited by a local attacker. The analysis of the provided patch, specifically commit 2c388a625606e637c32948f6cc22b5cf4439e26a, reveals the root cause. The patch modifies two files. The first, install/kubernetes/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml, is a configuration file for standalone Envoy deployments, where the fix is to add mode: 0660 to the admin socket configuration. The second, and more critical for identifying the vulnerable function, is pkg/envoy/embedded_envoy.go. The change in this file is within the writeBootstrapConfigFile function. Before the patch, this function created the Envoy admin socket's pipe without specifying any mode, leading to default, insecure permissions. The fix involves adding Mode: 0660 to the envoy_config_core.Pipe struct, thereby restricting access to the socket. Therefore, the function onDemandXdsStarter.writeBootstrapConfigFile is the precise location in the code where the vulnerability existed and would be the function appearing in a runtime profile during the creation of the insecure Envoy configuration.
onDemandXdsStarter.writeBootstrapConfigFilepkg/envoy/embedded_envoy.go