Skip to content

fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - abandoned#4803

Open
cilium-renovate[bot] wants to merge 1 commit into
v1.4from
renovate/v1.4-go-github.com-cilium-cilium-vulnerability
Open

fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - abandoned#4803
cilium-renovate[bot] wants to merge 1 commit into
v1.4from
renovate/v1.4-go-github.com-cilium-cilium-vulnerability

Conversation

@cilium-renovate
Copy link
Copy Markdown
Contributor

@cilium-renovate cilium-renovate Bot commented Mar 26, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
github.com/cilium/cilium v1.17.10 → v1.17.14 age confidence

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

BIT-cilium-2026-33726 / BIT-cilium-operator-2026-33726 / BIT-hubble-relay-2026-33726 / CVE-2026-33726 / GHSA-hxv8-4j4r-cqgv / GO-2026-4856

More information

Details

Impact

Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled.

Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (eni.enabled), AlibabaCloud ENI (alibabacloud.enabled), Azure IPAM (azure.enabled, but not AKS BYOCNI), and some GKE deployments (gke.enabled; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment.

Patches

This issue was fixed by #​44693.

This issue affects:

  • Cilium v1.19 between v1.19.0 and v1.19.1 inclusive
  • Cilium v1.18 between v1.18.0 and v1.18.7 inclusive
  • All versions of Cilium prior to v1.17.13

This issue is fixed in:

  • Cilium v1.19.2
  • Cilium v1.18.8
  • Cilium v1.17.14
Workarounds

Disclaimer: There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.

Acknowledgements

The Cilium community has worked together with members of the Northflank and Isovalent teams to prepare these mitigations. Cilium thanks @​sudeephb and @​Champ-Goblem for reporting the issue and to @​smagnani96 and @​julianwiedmann for helping with the resolution.

For more information

Anyone who believes a vulnerability affecting Cilium has been found is strongly encouraged to report it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and any such report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

BIT-cilium-2026-33726 / BIT-cilium-operator-2026-33726 / BIT-hubble-relay-2026-33726 / CVE-2026-33726 / GHSA-hxv8-4j4r-cqgv / GO-2026-4856

More information

Details

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.17.14: 1.17.14

Compare Source

Summary of Changes

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.17.14@​sha256:cdcfab5b4466d607f713d1ada281ee4513dd3982eb2c48ef2d0cc708cc3d1ba3

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.14@​sha256:6cc4e47b2a50649e739dbb61f266497e7ef53d048b60dc32ba563bd4efd7f0ba

docker-plugin

quay.io/cilium/docker-plugin:v1.17.14@​sha256:087072e60566cc37e21facec0e4096d49bef2e83cd340896ae477a7746819067

hubble-relay

quay.io/cilium/hubble-relay:v1.17.14@​sha256:ce5b991bb011fa744c94e04fd7f1a7d3c8e3ce7d2da0652766abe6c468ead990

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.14@​sha256:bdfa469e453986b995632f889cfb90bc501b80a809ff4b8be8d236eba5fcc2cb

operator-aws

quay.io/cilium/operator-aws:v1.17.14@​sha256:182c13e6edda041bfc885932d5e87b1d8ac3588f6f6af309944efee46a2193b2

operator-azure

quay.io/cilium/operator-azure:v1.17.14@​sha256:a462e7265ee34a667905c6144b7aa5d5ee8328ee1a4eca3f44bdc1463cc69741

operator-generic

quay.io/cilium/operator-generic:v1.17.14@​sha256:773886ec9337f6628ba84e36ac7e3e554c1622024fc2a8b04a3377970aee8889

operator

quay.io/cilium/operator:v1.17.14@​sha256:2113d66000847f39135722c61545ddb2c1bbd9fc4479f10dca175fc4bf9bda1b

v1.17.13: 1.17.13

Compare Source

Summary of Changes

Minor Changes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.17.13@​sha256:1e3907ba8815e2e474ea8da25876911af2da0ae07c04eaa87a326ba4343aa539

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.13@​sha256:3aeee4e88b68934f45faf211a1e6b1b7310ac31b2dda448f5df77860c57a71fa

docker-plugin

quay.io/cilium/docker-plugin:v1.17.13@​sha256:a37e314f585cb57165605c50449ed9fb4458d766689a328405644920ae6de6ee

hubble-relay

quay.io/cilium/hubble-relay:v1.17.13@​sha256:0c49b7363157849623099de9fc9378da7146f49e7d5f602d113223542b789ace

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.13@​sha256:a383d4c3896d150aad8e6f1d54df942e98e83033f381e5b9a7f424d1caf77471

operator-aws

quay.io/cilium/operator-aws:v1.17.13@​sha256:8c6faae3a985690d35f77309a1300f4dd0e8f11544537e2589ffa3c0132d978a

operator-azure

quay.io/cilium/operator-azure:v1.17.13@​sha256:4ad4c0cc236efe751f33fb1449a056af10654bc9cb7407862d412bc065ba6185

operator-generic

quay.io/cilium/operator-generic:v1.17.13@​sha256:c2582d9eaeec598de9cd8815a3ed20caade17c26858eea672cff3240b0970983

operator

quay.io/cilium/operator:v1.17.13@​sha256:581d5d54e5993be947cbce34fd5cb3401d124e2859dad0c947272f911b9b0d16

v1.17.12: 1.17.12

Compare Source

Summary of Changes

Major Changes:

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.17.12@​sha256:f525e12698149b3958024599493d9cc56fadbc46c9250cbced8016e9b9b679e5

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.12@​sha256:4c26ba1e62c44df28d58fc5bd8e1a87aa1d442aa081ff3e170e122f0106cd006

docker-plugin

quay.io/cilium/docker-plugin:v1.17.12@​sha256:4a17b4cfa041a0206242b2ead6c83598c2aec34c4d470c614d673840427f04e0

hubble-relay

quay.io/cilium/hubble-relay:v1.17.12@​sha256:ef2a294e81f91c74b729794f7098d61ee21b4c2efa11461c4e62623f5b5c240c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.12@​sha256:fda5705cb82d601172b25f098031960bf79cad86a43acc180e7176be001b263f

operator-aws

quay.io/cilium/operator-aws:v1.17.12@​sha256:9b9aebf43f6ddd59a2db05a523422842d69c88662a901effabda8bca242136be

operator-azure

quay.io/cilium/operator-azure:v1.17.12@​sha256:69c9aea1b3d41017fc5f0066b818d4b8c123067f53feef4d855baad9daeb6515

operator-generic

quay.io/cilium/operator-generic:v1.17.12@​sha256:0b675406b1e43b198962d4f9c3a5ba6bb68fc98836cba05b224860109112f6d9

operator

quay.io/cilium/operator:v1.17.12@​sha256:42d19b80461bad1d0f4f0f08aa23ff5a5e3950ef516c1c514cb053144da336b8

v1.17.11: 1.17.11

Compare Source

Summary of Changes

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.17.11@​sha256:260f7892b1e554f57618022070960bfbb78fc7a679feb934299f907e47ea8992

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.11@​sha256:cd298620390b388320b4e2178ab81f928160d410789eb590299e5d3877badace

docker-plugin

quay.io/cilium/docker-plugin:v1.17.11@​sha256:b8561a129770de63b776e7b7d3d02b8e5bb332507a14757284e9423f45fb1224

hubble-relay

quay.io/cilium/hubble-relay:v1.17.11@​sha256:e3fd2efae4563f06a15565af6c7e5b766ebb301b372acaa68e2f9184bafc98a6

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.11@​sha256:312dc6c796c809255dee302eebc613909500c5fe153df3f3b025c067f44e03bd

operator-aws

quay.io/cilium/operator-aws:v1.17.11@​sha256:363779644fc8a6d1f503140548fb3e8d0a861e27d2ee2ff4d86d75802beeea6e

operator-azure

quay.io/cilium/operator-azure:v1.17.11@​sha256:0782670b423ae84bef6728dd8626e2a6bd0512737207aa128392d70450fe5418

operator-generic

quay.io/cilium/operator-generic:v1.17.11@​sha256:dbd985d5b5602a4f2ae4aafd1332829bdd7d3bf452164b7288c90e3470590422

operator

quay.io/cilium/operator:v1.17.11@​sha256:5158e04f5a4e6d1a60f56e1aa5c23db685edd22d54cad23a06441187a38272a5

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@cilium-renovate cilium-renovate Bot added release-blocker This PR or issue is blocking the next release. release-note/dependency This PR updates one or multiple dependencies labels Mar 26, 2026
@cilium-renovate
Copy link
Copy Markdown
Contributor Author

cilium-renovate Bot commented Mar 26, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 9 additional dependencies were updated

Details:

Package Change
k8s.io/api v0.32.3 -> v0.32.13
k8s.io/apiextensions-apiserver v0.32.3 -> v0.32.13
k8s.io/apimachinery v0.32.3 -> v0.32.13
k8s.io/apiserver v0.32.3 -> v0.32.13
k8s.io/client-go v0.32.3 -> v0.32.13
k8s.io/code-generator v0.32.3 -> v0.32.13
sigs.k8s.io/controller-runtime v0.20.3 -> v0.20.4
k8s.io/component-base v0.32.3 -> v0.32.13
k8s.io/utils v0.0.0-20241210054802-24370beab758 -> v0.0.0-20260210185600-b8788abfbbc2
File name: pkg/k8s/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 13 additional dependencies were updated

Details:

Package Change
golang.org/x/sync v0.17.0 -> v0.18.0
k8s.io/apiextensions-apiserver v0.32.3 -> v0.32.13
k8s.io/apimachinery v0.32.3 -> v0.32.13
k8s.io/client-go v0.32.3 -> v0.32.13
k8s.io/code-generator v0.32.3 -> v0.32.13
golang.org/x/mod v0.27.0 -> v0.29.0
golang.org/x/net v0.45.0 -> v0.47.0
golang.org/x/sys v0.36.0 -> v0.38.0
golang.org/x/term v0.35.0 -> v0.37.0
golang.org/x/text v0.29.0 -> v0.31.0
golang.org/x/tools v0.36.0 -> v0.38.0
k8s.io/api v0.32.3 -> v0.32.13
k8s.io/utils v0.0.0-20241210054802-24370beab758 -> v0.0.0-20260210185600-b8788abfbbc2

@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed Apr 13, 2026
@cilium-renovate cilium-renovate Bot closed this Apr 13, 2026
@cilium-renovate cilium-renovate Bot deleted the renovate/v1.4-go-github.com-cilium-cilium-vulnerability branch April 13, 2026 18:25
@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) Apr 16, 2026
@cilium-renovate cilium-renovate Bot reopened this Apr 16, 2026
@cilium-renovate cilium-renovate Bot force-pushed the renovate/v1.4-go-github.com-cilium-cilium-vulnerability branch 3 times, most recently from b6e81a0 to b55832c Compare April 22, 2026 19:31
@mtardy mtardy self-requested a review April 23, 2026 09:08
@mtardy
Copy link
Copy Markdown
Member

mtardy commented Apr 23, 2026

Based on your latest patch with renovate and vendor would you know what could be happening here @dangome3 ?

mtardy
mtardy requested changes Apr 23, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@mtardy mtardy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to fix it manually or fix it systematically (better) by finding out what went wrong.

@dangome3
Copy link
Copy Markdown
Contributor

dangome3 commented Apr 23, 2026

Hey @mtardy 👋

I checked for a while what happened in the run that updated this commit, is this one renovate run

It didn't run the postUpgradeTasks at all, and I guess the reason for that is because this update is not managed by go.mod directly, but for this custom manager

tetragon/.github/renovate.json5

Lines 522 to 530 in 38a6543

{
"customType": "regex",
"managerFilePatterns": [
"tests/e2e/flags/flags.go"
],
"matchStrings": [
"\\/\\/ renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+CiliumVersion:\\s*\"(?<currentValue>.*?)\""
]
},

I think that is the issue for two reasons, first this log in the renovate run when it starts to update the branch:

DEBUG: Starting search at index 609 (repository=cilium/tetragon, baseBranch=v1.4, packageFile=tests/e2e/flags/flags.go, branch=renovate/v1.4-go-github.com-cilium-cilium-vulnerability)

Notice the packageFile=tests/e2e/flags/flags.go part, the other reason is that this specific file is also updated, which I guess wouldn't happen if this is just a go.mod update.

That being said, I would like to try the following fix:

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index d9e247f63..972b575d0 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -526,7 +526,12 @@
       ],
       "matchStrings": [
         "\\/\\/ renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+CiliumVersion:\\s*\"(?<currentValue>.*?)\""
-      ]
+      ],
+      "postUpgradeTasks": {
+        "commands": ["make vendor"],
+        "fileFilters": ["**/**"],
+        "executionMode": "branch"
+      }
     },
     {
       "customType": "regex",

I din't include the other commands because I think just updating cilium would not change the crds but I'm not 100% sure about that, what do you think? Should we try it?

@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed Apr 23, 2026
@cilium-renovate cilium-renovate Bot closed this Apr 23, 2026
@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) Apr 23, 2026
@cilium-renovate cilium-renovate Bot reopened this Apr 23, 2026
@cilium-renovate cilium-renovate Bot force-pushed the renovate/v1.4-go-github.com-cilium-cilium-vulnerability branch 2 times, most recently from b55832c to e5a4c73 Compare April 23, 2026 20:50
@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed Apr 28, 2026
@cilium-renovate cilium-renovate Bot closed this Apr 28, 2026
@cilium-renovate
fix(deps): update module github.com/cilium/cilium to v1.17.14 [security]
009682b 
Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com>
@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - autoclosed fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) Apr 28, 2026
@cilium-renovate cilium-renovate Bot reopened this Apr 28, 2026
@cilium-renovate cilium-renovate Bot force-pushed the renovate/v1.4-go-github.com-cilium-cilium-vulnerability branch 2 times, most recently from e5a4c73 to 009682b Compare April 28, 2026 13:12
@cilium-renovate cilium-renovate Bot changed the title fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) fix(deps): update module github.com/cilium/cilium to v1.17.14 [security] (v1.4) - abandoned Apr 29, 2026
@cilium-renovate
Copy link
Copy Markdown
Contributor Author

cilium-renovate Bot commented Apr 29, 2026

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mtardy mtardy mtardy requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

release-blocker This PR or issue is blocking the next release. release-note/dependency This PR updates one or multiple dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mtardy @dangome3