{"schemaVersion":3,"id":"CVE-2025-23047","aliases":["CGA-2p59-9rm4-hcrx","CGA-35v7-63h2-xp64","CGA-6ghj-8p8v-7743","CGA-hjfj-mr6w-2g8x","CGA-qrp7-gpvx-h593","CGA-xhx2-3539-4mgr","GHSA-h78m-j95m-5356","BIT-cilium-2025-23047","BIT-cilium-operator-2025-23047","BIT-hubble-relay-2025-23047","GO-2025-3416","CGA-2m57-fcpc-33hr","CGA-3j29-4q9q-xx4m","CGA-49rv-q663-rmr3","CGA-4cr2-ffrf-grvr","CGA-6638-w4gh-j58h","CGA-74vw-42cf-47q9","CGA-9cg7-mxj2-r76x","CGA-c7x8-m3f6-7c4h","CGA-fcv8-pfhj-2v6x","CGA-g6vq-3xjv-cg46","CGA-pqp8-46c4-q947","CGA-r785-4vm9-rmmp"],"status":"published","duplicateOf":null,"title":"Cilium vulnerable to information leakage via insecure default Hubble UI CORS header","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.","dates":{"published":"2025-01-22T17:20:09.715Z","modified":"2025-02-12T20:41:24.045Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00499,"percentile":0.4186,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00499},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00499,"percentile":0.4186}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00499,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00499,"percentile":0.4186}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"chainguard","product":"cilium-1.15","name":"cilium-1.15","label":"cilium-1.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cilium-1.15","purlType":"apk","versions":[{"text":"< 1.15.13-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.15.13-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cilium-1.16","name":"cilium-1.16","label":"cilium-1.16","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cilium-1.16","purlType":"apk","versions":[{"text":"< 1.16.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cilium-fips-1.15","name":"cilium-fips-1.15","label":"cilium-fips-1.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cilium-fips-1.15","purlType":"apk","versions":[{"text":"< 1.15.13-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.15.13-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cilium-fips-1.16","name":"cilium-fips-1.16","label":"cilium-fips-1.16","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cilium-fips-1.16","purlType":"apk","versions":[{"text":"< 1.16.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hubble","name":"hubble","label":"hubble","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hubble","purlType":"apk","versions":[{"text":"< 1.16.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hubble-fips","name":"hubble-fips","label":"hubble-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hubble-fips","purlType":"apk","versions":[{"text":"< 1.16.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hubble-ui","name":"hubble-ui","label":"hubble-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hubble-ui","purlType":"apk","versions":[{"text":"< 0.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hubble-ui-backend","name":"hubble-ui-backend","label":"hubble-ui-backend","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hubble-ui-backend","purlType":"apk","versions":[{"text":"< 0.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hubble-ui-backend-fips","name":"hubble-ui-backend-fips","label":"hubble-ui-backend-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hubble-ui-backend-fips","purlType":"apk","versions":[{"text":"< 0.13.1-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"hubble","name":"hubble","label":"hubble","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/hubble","purlType":"apk","versions":[{"text":"< 1.16.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.6-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"hubble-ui","name":"hubble-ui","label":"hubble-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/hubble-ui","purlType":"apk","versions":[{"text":"< 0.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"hubble-ui-backend","name":"hubble-ui-backend","label":"hubble-ui-backend","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/hubble-ui-backend","purlType":"apk","versions":[{"text":"< 0.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1-r10","eol":null,"hubHref":null},{"vendor":"cilium","product":"cilium","name":"cilium","label":"cilium","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.14.0, < 1.14.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.15.0, < 1.15.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.16.0, < 1.16.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.14.0, < 1.14.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.15.0, < 1.15.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.16.0, < 1.16.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.14.0, < 1.14.18 | ≥ 1.15.0, < 1.15.12 | ≥ 1.16.0, < 1.16.5 | ≥ 1.14.0, < 1.14.19 | ≥ 1.15.0, < 1.15.13 | ≥ 1.16.0, < 1.16.6","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"cilium","label":"Cilium","category":"server-app"}},"hubHref":"/vendor/cilium/cilium"},{"vendor":"github.com/cilium","product":"cilium","name":"github.com/cilium/cilium","label":"cilium","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/cilium/cilium","purlType":"golang","versions":[{"text":"≥ 1.14.0, < 1.14.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.15.0, < 1.15.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.16.0, < 1.16.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.14.0, < 1.14.19 | ≥ 1.15.0, < 1.15.13 | ≥ 1.16.0, < 1.16.6","eol":null,"hubHref":null}],"affectedCount":14,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356","label":"github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Patch","Third Party Advisory"]},{"url":"https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d","label":"github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23047.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23047.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23047","label":"nvd.nist.gov/vuln/detail/CVE-2025-23047","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/cilium/cilium","label":"github.com/cilium/cilium","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:14710-1","SUSE-SU-2025:0297-1"],"duplicates":[],"related":["CGA-3VVV-66C4-MMV3","CGA-8XMQ-FRQP-RWXM","CGA-FG5P-PF8V-388Q","CGA-JF5P-9X7W-8GF5","CGA-JGQH-85P9-P4Q4","CGA-PG5H-FW7M-RGW8","CGA-QHG9-W8MR-32VM","CGA-V4J9-MP6R-P3HV","OPENSUSE-SU-2025:14710-1","SUSE-SU-2025:0297-1"]},"timeline":[{"kind":"published","date":"2025-01-22T17:20:09.715Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-12T20:41:24.045Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T17:40:24.483Z","stale":false,"partial":false}}