CVE-2025-67499: containernetworking plugins

CVSS: 6.6v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2025-67499CGA-23g6-fv8h-74rfCGA-2453-9q37-qc3p+432 more

Published 09-12-2025Last modified 10-12-2025

Vulnerability summary

CVE-2025-67499 is a medium (CVSS 6.6) vulnerability in containernetworking plugins. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.9% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.6/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.14%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 12

OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0037-1 CGA-4J34-WMMH-MX3C CGA-6F67-8GHW-V9RR CGA-9GMR-J7HP-2MVF CGA-F7VG-3XVX-J4J4+6 more

Timeline

09-12-2025
PublishedVulnerability first disclosed.
10-12-2025
Last modifiedVulnerability information updated.

Description

The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.6

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Chainguard200 products

amazon-k8s-cni-fips< 1.20.5-r2
amazon-k8s-cni-init-fips< 1.20.5-r2
amazon-k8s-cni-init-fips-compat< 1.20.5-r2
azure-ipam< 0.4.0-r7
azure-ipam-dropgz< 0.4.0-r7

buildah< 1.42.2-r2
buildctl< 0.26.2-r2
buildctl-fips< 0.26.2-r3
buildkitd< 0.26.2-r2
buildkitd-fips< 0.26.2-r3
calico-3.30< 3.30.5-r3
calico-3.31< 3.31.2-r4
calico-apiserver-3.30< 3.30.5-r3
calico-apiserver-3.31< 3.31.2-r4
calico-apiserver-compat-3.30< 3.30.5-r3
calico-apiserver-compat-3.31< 3.31.2-r4
calico-apiserver-fips-3.30< 3.30.5-r3
calico-apiserver-fips-3.31< 3.31.2-r4
calico-app-policy-3.30< 3.30.5-r3
calico-app-policy-3.31< 3.31.2-r4
calico-app-policy-fips-3.30< 3.30.5-r3
calico-app-policy-fips-3.31< 3.31.2-r4
calico-cni-3.30< 3.30.5-r3
calico-cni-3.31< 3.31.2-r4
calico-cni-compat-3.30< 3.30.5-r3
calico-cni-compat-3.31< 3.31.2-r4
calico-cni-compat-fips-3.30< 3.30.5-r3
calico-cni-compat-fips-3.31< 3.31.2-r4
calico-cni-fips-3.30< 3.30.5-r3
calico-cni-fips-3.31< 3.31.2-r4
calico-felix-3.30< 3.30.5-r3
calico-felix-fips-3.30< 3.30.5-r3
calico-felix-fips-3.31< 3.31.2-r4
calico-fips-3.30< 3.30.5-r3
calico-fips-3.31< 3.31.2-r4
calico-goldmane-3.30< 3.30.5-r3
calico-goldmane-3.31< 3.31.2-r4
calico-goldmane-fips-3.30< 3.30.5-r3
calico-goldmane-fips-3.31< 3.31.2-r4
calico-key-cert-provisioner-3.30< 3.30.5-r3
calico-key-cert-provisioner-3.31< 3.31.2-r4
calico-key-cert-provisioner-fips-3.30< 3.30.5-r3
calico-key-cert-provisioner-fips-3.31< 3.31.2-r4
calico-kube-controllers-3.30< 3.30.5-r3
calico-kube-controllers-3.31< 3.31.2-r4
calico-kube-controllers-fips-3.30< 3.30.5-r3
calico-kube-controllers-fips-3.31< 3.31.2-r4
calico-node-3.30< 3.30.5-r3
calico-node-3.31< 3.31.2-r4
calico-node-fips-3.30< 3.30.5-r3
calico-node-fips-3.31< 3.31.2-r4
calico-pod2daemon-3.30< 3.30.5-r3
calico-pod2daemon-3.31< 3.31.2-r4
calico-pod2daemon-fips-3.30< 3.30.5-r3
calico-pod2daemon-fips-3.31< 3.31.2-r4
calico-pod2daemon-flexvol-compat-3.30< 3.30.5-r3
calico-typha-client-3.30< 3.30.5-r3
calico-typha-client-3.31< 3.31.2-r4
calico-typha-client-fips-3.30< 3.30.5-r3
calico-typha-client-fips-3.31< 3.31.2-r4
calico-typhad-3.30< 3.30.5-r3
calico-typhad-3.31< 3.31.2-r4
calico-typhad-fips-3.30< 3.30.5-r3
calico-typhad-fips-3.31< 3.31.2-r4
calico-whisker-3.30< 3.30.5-r3
calico-whisker-3.31< 3.31.2-r4
calico-whisker-backend-3.30< 3.30.5-r3
calico-whisker-backend-3.31< 3.31.2-r4
calico-whisker-backend-fips-3.30< 3.30.5-r3
calico-whisker-backend-fips-3.31< 3.31.2-r4
calico-whisker-fips-3.30< 3.30.5-r3
calico-whisker-fips-3.31< 3.31.2-r4
calicoctl-3.30< 3.30.5-r3
calicoctl-3.31< 3.31.2-r4
calicoctl-fips-3.30< 3.30.5-r3
calicoctl-fips-3.31< 3.31.2-r4
containerd-2< 2.2.0-r4
containerd-fips< 2.2.0-r4
containerd-service-2< 2.2.0-r4
containerd-service-fips< 2.2.0-r4
containerd-shim-runc-v2-2< 2.2.0-r4
containerd-shim-runc-v2-fips< 2.2.0-r4
containerd-stress-2< 2.2.0-r4
containerd-stress-fips< 2.2.0-r4
ctr-2< 2.2.0-r4
ctr-fips< 2.2.0-r4
datadog-agent-7.77< 7.77.3-r14
datadog-agent-7.78< 7.78.4-r9
datadog-agent-fips-7.77< 7.77.3-r12
datadog-agent-fips-7.78< 7.78.4-r6
docker< 28.5.2-r8
docker-config-mirror-gcr< 28.5.2-r8
docker-dind< 28.5.2-r8
docker-fips< 28.5.2-r3
docker-init< 28.5.2-r8
docker-oci-entrypoint< 28.5.2-r8
dockerd< 28.5.2-r8
dockerd-oci-entrypoint< 28.5.2-r8
dockerd-service< 28.5.2-r8
dogstatsd-7.77< 7.77.3-r14
dogstatsd-7.78< 7.78.4-r9
flannel< 0.27.4-r6
flannel-compat< 0.27.4-r6
flannel-fips< 0.27.4-r4
flannel-fips-compat< 0.27.4-r4
istio-1.26< 1.26.7-r1
istio-1.27< 1.27.4-r1
istio-1.28< 1.28.1-r1
istio-cni-1.26< 1.26.7-r1
istio-cni-1.26-compat< 1.26.7-r1
istio-cni-1.27< 1.27.4-r1
istio-cni-1.27-compat< 1.27.4-r1
istio-cni-1.28< 1.28.1-r1
istio-cni-1.28-compat< 1.28.1-r1
istio-cni-fips-1.25< 1.25.5-r6
istio-cni-fips-1.25-compat< 1.25.5-r6
istio-cni-fips-1.26< 1.26.7-r1
istio-cni-fips-1.26-compat< 1.26.7-r1
istio-cni-fips-1.28< 1.28.1-r1
istio-cni-fips-1.28-compat< 1.28.1-r1
istio-fips-1.25< 1.25.5-r6
istio-fips-1.26< 1.26.7-r1
istio-fips-1.28< 1.28.1-r1
istio-install-cni-1.26< 1.26.7-r1
istio-install-cni-1.26-compat< 1.26.7-r1
istio-install-cni-1.27< 1.27.4-r1
istio-install-cni-1.27-compat< 1.27.4-r1
istio-install-cni-1.28< 1.28.1-r1
istio-install-cni-1.28-compat< 1.28.1-r1
istio-install-cni-fips-1.25< 1.25.5-r6
istio-install-cni-fips-1.25-compat< 1.25.5-r6
istio-install-cni-fips-1.26< 1.26.7-r1
istio-install-cni-fips-1.26-compat< 1.26.7-r1
istio-install-cni-fips-1.27< 1.27.4-r1
istio-install-cni-fips-1.28< 1.28.1-r1
istio-install-cni-fips-1.28-compat< 1.28.1-r1
istio-pilot-agent-1.25< 1.25.5-r5
istio-pilot-agent-1.25-compat< 1.25.5-r5
istio-pilot-agent-1.26< 1.26.7-r1
istio-pilot-agent-1.26-compat< 1.26.7-r1
istio-pilot-agent-1.27< 1.27.4-r1
istio-pilot-agent-1.27-compat< 1.27.4-r1
istio-pilot-agent-1.28< 1.28.1-r1
istio-pilot-agent-1.28-compat< 1.28.1-r1
istio-pilot-agent-fips-1.25< 1.25.5-r6
istio-pilot-agent-fips-1.25-compat< 1.25.5-r6
istio-pilot-agent-fips-1.26< 1.26.7-r1
istio-pilot-agent-fips-1.26-compat< 1.26.7-r1
istio-pilot-agent-fips-1.28< 1.28.1-r1
istio-pilot-agent-fips-1.28-compat< 1.28.1-r1
istio-pilot-discovery-1.26< 1.26.7-r1
istio-pilot-discovery-1.26-compat< 1.26.7-r1
istio-pilot-discovery-1.27< 1.27.4-r1
istio-pilot-discovery-1.27-compat< 1.27.4-r1
istio-pilot-discovery-1.28< 1.28.1-r1
istio-pilot-discovery-1.28-compat< 1.28.1-r1
istio-pilot-discovery-fips-1.25< 1.25.5-r6
istio-pilot-discovery-fips-1.26< 1.26.7-r1
istio-pilot-discovery-fips-1.28< 1.28.1-r1
istioctl-1.26< 1.26.7-r1
istioctl-1.27< 1.27.4-r1
istioctl-1.28< 1.28.1-r1
istioctl-bash-completion-1.26< 1.26.7-r1
istioctl-bash-completion-1.27< 1.27.4-r1
istioctl-bash-completion-1.28< 1.28.1-r1
istioctl-zsh-completion-1.26< 1.26.7-r1
istioctl-zsh-completion-1.27< 1.27.4-r1
istioctl-zsh-completion-1.28< 1.28.1-r1
k3s< 1.35.0.3-r0 | < 1.35.3.1-r0
k3s-1.32< 1.32.11.3-r0 | All versions (No fix recorded)
k3s-1.33< 1.33.10.1-r0 | < 1.33.7.3-r0
k3s-static< 1.35.0.3-r0 | < 1.35.3.1-r0
k3s-static-1.32< 1.32.11.3-r0 | All versions (No fix recorded)
k3s-static-1.33< 1.33.7.3-r0 | < 1.33.10.1-r0
kuma-2.10< 2.10.8-r3
kuma-2.11< 2.11.7-r3
kuma-2.12< 2.12.3-r3
kuma-cni-2.10< 2.10.8-r3
kuma-cni-2.11< 2.11.7-r3
kuma-cni-2.12< 2.12.3-r3
kuma-cni-compat-2.10< 2.10.8-r3
kuma-cni-compat-2.11< 2.11.7-r3
kuma-cni-compat-2.12< 2.12.3-r3
kuma-cp-2.10< 2.10.8-r3
kuma-cp-2.11< 2.11.7-r3
kuma-cp-2.12< 2.12.3-r3
kuma-dp-2.10< 2.10.8-r3
kuma-dp-2.11< 2.11.7-r3
kuma-dp-2.12< 2.12.3-r3
kuma-install-cni-2.10< 2.10.8-r3
kuma-install-cni-2.11< 2.11.7-r3
kuma-install-cni-2.12< 2.12.3-r3
kumactl-2.10< 2.10.8-r3
kumactl-2.11< 2.11.7-r3
kumactl-2.12< 2.12.3-r3
multus-cni< 4.2.3-r2
multus-cni-compat< 4.2.3-r2
multus-cni-fips< 4.2.3-r3
nerdctl< 2.2.0-r5
nerdctl-fips< 2.2.0-r3

Show all 200

1 vendor · 200 products · Showing 200 of 295. Use Open JSON for the complete list.

References

11 links

github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rmX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/containernetworking/plugins/pull/1210X Refsource MISCREPORTFIXWEBIssue TrackingPatch
github.com/containernetworking/plugins/releases/tag/v1.9.0X Refsource MISCREPORTWEBProductRelease Notes
ubuntu.com/security/CVE-2025-67499REPORT
www.cve.org/CVERecord?id=CVE-2025-67499REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67499.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-67499Advisory
github.com/containernetworking/plugins/commit/9b3772e1a7abf93cbb7c6526a28bc0d27b830e02WEBFIX
github.com/containernetworking/pluginsPACKAGE
pkg.go.dev/vuln/GO-2026-4222WEB

Show all 11 references

www.suse.com/security/cve/CVE-2025-67499WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities