CVE-2023-30851 - CVE House

Back to Database

Status published Low CVE-2023-30851

Potential HTTP policy bypass when using header rules in Cilium

2.6 CVSS

Vulnerability Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-30851

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from cilium

View All →

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Hubble CLI vulnerable to character injection

Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Node based network policies may incorrectly allow workload traffic

East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

Affected Vendor

cilium

View all reports →

Affected Software

cilium

Vulnerable Versions:

< 1.11.16, >= 1.12.0, < 1.12.9, >= 1.13.0, < 1.13.2

Timeline

Official Publish: May 25th, 2023

Last Modified: January 16th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1562 Impair Defenses

Defense Evasion

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1550 Use Alternate Authentication Material

Defense Evasion

T1485 Data Destruction