Impact In a cluster with "SDS" (https://docs.cilium.io/en/stable/security/tls-visibility/#secret-discovery-service-sds) enabled for L7 network policies, an attacker may be able to affect policy enforcement behaviour by exploiting name collisions between synced Secret and ConfigMap objects. A namespaced attacker who can create a Secret or ConfigMap and a referencing CiliumNetworkPolicy may be able to choose object names that collide with a victim object. The attacker-controlled object can then overwrite the synchronized SDS object used by the victim policy, including policies using headerMatches.secret. This can change policy enforcement behavior, allowing unauthorized traffic that should have been denied, or denying legitimate traffic that should have been allowed. ### Patches This issue affects: * Cilium v1.17 between v1.17.0 and v1.17.17 inclusive * Cilium v1.18 between v1.18.0 and 1.18.11 inclusive * Cilium v1.19 between v1.19.0 and 1.19.5 inclusive This issue has been patched in: * Cilium v1.17.18 * Cilium v1.18.12 * Cilium v1.19.6 ### Workarounds Operators can mitigate the Network Policy SDS collision by disabling policy Secret synchronization and managing referenced policy Secrets directly in the configured policy secrets namespace ("cilium-secrets" by default). ### Acknowledgements Special thanks to @robertprast for reporting this issue, @nezdolik for preparing the fix, and @youngnick for their assistance in reviewing the solution. ### For more information If you have any questions or comments about this advisory, please reach out on "Slack" (https://docs.cilium.io/en/latest/community/community/). If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at "security@cilium.io" (mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.