CVE-2025-30163

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-301646.1Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 aCVE-2025-301658.0vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ forCVE-2025-301664.8Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending funcCVE-2025-301677.3Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, CVE-2025-301686.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd paCVE-2025-301696.7File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This iCVE-2025-30175.3A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of tCVE-2025-301705.5Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session CVE-2025-301719.0System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become cCVE-2025-301728.0Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECCVE-2025-301736.7File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-EnterpriCVE-2025-301747.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V