CVE-2025-30163 Overview
Cilium is an eBPF-based networking, observability, and security solution for Kubernetes environments. CVE-2025-30163 is an authorization flaw [CWE-863] affecting the fromNodes and toNodes node-based network policy selectors. Cilium incorrectly permits traffic to and from non-node endpoints when those endpoints share labels specified in node-based policy rules. The issue affects Cilium v1.16.0 through v1.16.7 and v1.17.0 through v1.17.1. Node-based network policy is disabled by default in Cilium, limiting the exposed attack surface. The vulnerability requires adjacent network access to exploit and can lead to unauthorized cluster traffic reaching workloads that share node labels.
Critical Impact
Non-node endpoints sharing labels with nodes can bypass fromNodes and toNodes network policy restrictions, permitting unauthorized east-west traffic within Kubernetes clusters.
Affected Products
- Cilium v1.16.0 through v1.16.7 (inclusive)
- Cilium v1.17.0 through v1.17.1 (inclusive)
- Deployments using fromNodes or toNodes network policy selectors
Discovery Timeline
- 2025-03-24 - CVE-2025-30163 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30163
Vulnerability Analysis
Cilium enforces network policies through eBPF programs attached to workload interfaces. Node-based network policies use the fromNodes and toNodes selectors to restrict traffic between Kubernetes nodes and pods based on node labels. The policy engine matches endpoints against label selectors to determine whether traffic should be permitted or dropped.
The vulnerability arises because the label matching logic does not verify that the matched endpoint is actually a node. Any endpoint sharing the labels used in fromNodes or toNodes rules is treated as a node for policy evaluation. An attacker controlling a workload with those labels can send or receive traffic that policies intended to restrict to nodes only. This breaks the trust boundary that node-based policies are designed to enforce.
Root Cause
The root cause is an authorization gap [CWE-863] in the policy resolver. The resolver evaluates label selectors without applying a node-specific identity constraint. As a result, endpoint identity is inferred from labels alone rather than verified against a node membership attribute.
Attack Vector
Exploitation requires adjacent network access and the ability to run or influence a workload that carries the same labels used by node-based policies. An attacker who deploys a pod with matching labels, or who compromises an existing workload sharing those labels, can send traffic that policy authors expected only nodes to be able to send. The impact is limited to confidentiality of traffic paths and does not affect integrity or availability.
No public proof-of-concept exploit is available and CVE-2025-30163 is not listed on the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory GHSA-c6pf-2v8j-96mc for vendor technical details.
Detection Methods for CVE-2025-30163
Indicators of Compromise
- Non-node pods carrying labels that match those referenced in fromNodes or toNodes policy selectors
- Unexpected east-west connections to workloads gated by node-based network policies
- Cilium flow logs showing permitted traffic between pod endpoints and services intended to be node-only
Detection Strategies
- Audit deployed CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy resources for use of fromNodes and toNodes selectors
- Cross-reference selector labels against pod labels cluster-wide to identify non-node endpoints that match
- Use Hubble flow logs to monitor traffic permitted under node-based rules and validate source identity
Monitoring Recommendations
- Enable Hubble observability and export flow data to a centralized analytics platform for label-based correlation
- Alert when new pods are created with labels reserved for nodes
- Track Cilium version across clusters to identify hosts running v1.16.0 through v1.16.7 or v1.17.0 through v1.17.1
How to Mitigate CVE-2025-30163
Immediate Actions Required
- Upgrade Cilium to v1.16.8, v1.17.2, or later where the label matching logic is corrected
- Inventory all network policies using fromNodes and toNodes and identify label overlap with non-node workloads
- Restrict pod deployment permissions so untrusted tenants cannot assign node-reserved labels
Patch Information
The fix is delivered in Cilium v1.16.8 and v1.17.2. The upstream code change is available in the Cilium GitHub Pull Request #36657. Review the GitHub Security Advisory GHSA-c6pf-2v8j-96mc for the complete fix summary and upgrade guidance.
Workarounds
- Ensure labels used in fromNodes and toNodes policy fields are exclusive to nodes and never applied to pods or other endpoints
- Introduce dedicated node-only labels such as node-role.kubernetes.io/* for use in node-based policies
- Use admission controllers to reject workloads that request node-reserved labels
- Refer to the Cilium Policy Language Documentation for guidance on structuring node-based rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
