Impact On nodes using VLAN interfaces, Cilium may fail to enforce ingress host policies and L7 network policies for connections from outside the node. Only nodes on which Cilium is attached to both a VLAN interface and its parent are affected. Cilium TCX attachment must also be enabled, as is the case on kernel 6.2 and newer. If these conditions are met, Cilium will incorrectly treat packets received on the VLAN interface as having already passed through the proxy (resp. the host firewall) and skip policy enforcement on the destination endpoint. An attacker with the ability to send traffic to targeted pods could therefore reach those pods even when policies should otherwise deny that traffic. Same-node pod traffic is not known to be affected. Non-host L3 and L4 policies are not affected. Source-side egress policies, if configured to deny the traffic, may still provide protection. ### Patches This issue affects: - Cilium v1.18 between v1.18.0 and v1.18.8 inclusive - Cilium v1.17 between v1.17.0 and v1.17.14 inclusive - All versions of Cilium v1.16 This issue has been patched in: - Cilium v1.18.9 - Cilium v1.7.15 ### Workarounds - Users who are unable to upgrade can work around this issue by disabling TCX: "--enable-tcx=false" as an agent flag or "bpf.enableTCX: false" via the Cilium Helm chart. - Depending on cluster configuration and use cases, it may also be possible to configure egress policies to mitigate this issue. ### Acknowledgements The Cilium community has worked together with members of Hetzner and Isovalent to prepare these mitigations. Special thanks to @marvin-roesch and @abcdegorov for reporting the issue and @pchaigno for their work on triaging and remediating this issue. ### For more information If you have any questions or comments about this advisory, please reach out on "Slack" (https://docs.cilium.io/en/latest/community/community/). If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at "security@cilium.io" (mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.