5.5

CVE-2023-27593: cilium-agent container can access the host via `hostPath` mount

Modified
AliasesGHSA-4hc4-pgfx-3mrxBIT-cilium-2023-27593BIT-cilium-operator-2023-27593
Published 17-03-2023Last modified 25-02-2025

Vulnerability summary

CVE-2023-27593 is a medium (CVSS 5.5) Incorrect Default Permissions vulnerability in cilium. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.4% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 5
CGA-28PW-8H26-F76PCGA-8XJ4-5F2Q-7QCFCGA-GH89-344P-848HCGA-RW35-6M7P-47PRCGA-VH9R-6VR8-4G3X

Timeline

  1. 17-03-2023
    PublishedVulnerability first disclosed.
  2. 25-02-2025
    Last modifiedVulnerability information updated.

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. The issue has been fixed and the fix is available on versions 1.11.15, 1.12.8, and 1.13.1. Some workarounds are available. Kubernetes RBAC should be used to deny users and service accounts `exec` access to Cilium agent pods. In cases where a user requires `exec` access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.22% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard17 products
  • cilium-1.15All versions (No fix recorded)
  • cilium-1.15-clustermesh-apiserverAll versions (No fix recorded)
  • cilium-1.15-container-initAll versions (No fix recorded)
  • cilium-1.15-container-init-compatAll versions (No fix recorded)
  • cilium-1.15-hubble-relayAll versions (No fix recorded)
Cilium1 product
  • cilium< 1.11.15 | ≥ 1.12.0, < 1.12.8 | ≥ 1.13.0, < 1.13.1
Github.com/cilium1 product
  • cilium< 1.11.15 | ≥ 1.12.0, < 1.12.8 | ≥ 1.13.0, < 1.13.1

3 vendors · 19 products

References

10 links