Most recent entries from all

BIT-cilium-2023-30851 — Potential HTTP policy bypass when using header rules in Cilium

2026-10-09T10:02:21.004539+00:00

Affected: Bitnami: cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

EUVD-2026-210777

2026-10-09T10:02:21.004589+00:00

EUVD-2026-210777

fkie_cve-2023-30851

2026-10-09T10:02:21.004606+00:00

GHSA-2h44-x2wx-49f4 — Potential HTTP policy bypass when using header rules in Cilium

2026-10-09T10:02:21.004630+00:00

Affected: Go: github.com/cilium/cilium

### Impact

This issue only impacts users who:

- Have a HTTP policy that applies to multiple `toEndpoints` AND - Have an allow-all rule in place that affects only one of those endpoints

In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.

### Patches

This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

### Workarounds

Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:

``` egress: - toEndpoints: - matchLabels: k8s:kind: echo - matchLabels: k8s:kind: example toPorts: - ports: - port: "8080" protocol: TCP rules: http: - method: "GET" ```

It should be rewritten to: ``` egress: - toEndpoints: - matchLabels: k8s:kind: echo toPorts: - ports: - port: "8080" protocol: TCP rules: http: - method: "GET" - toEndpoints: - matchLabels: k8s:kind: example toPorts: - ports: - port: "8080" protocol: TCP rules: http: - method: "GET" ```

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.

### For more inform…

gsd-2023-30851

2026-10-09T10:02:21.004681+00:00

gsd-2023-30851