CVE-2025-32793: Cilium Race Condition Vulnerability

CVE-2025-32793 Overview

CVE-2025-32793 affects Cilium, an eBPF-based networking, observability, and security solution for Kubernetes environments. A race condition in packet processing causes traffic from terminating endpoints to leave the source node without WireGuard encryption. The flaw impacts clusters that rely on WireGuard transparent encryption to protect pod-to-pod traffic. Affected releases include 1.15.0 through 1.15.15, 1.16.0 through 1.16.8, and 1.17.0 through 1.17.2. The Cilium maintainers patched the issue in 1.15.16, 1.16.9, and 1.17.3. The vulnerability is tracked under [CWE-319] cleartext transmission of sensitive information and [CWE-362] concurrent execution using shared resource with improper synchronization.

Critical Impact
Pod traffic expected to be encrypted with WireGuard can transit the network in cleartext, exposing sensitive workload communications to on-path observers.

Affected Products

Cilium 1.15.0 to 1.15.15
Cilium 1.16.0 to 1.16.8
Cilium 1.17.0 to 1.17.2

Discovery Timeline

2025-04-21 - CVE-2025-32793 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32793

Vulnerability Analysis

Cilium provides transparent encryption between nodes using WireGuard. Traffic between pods on different nodes is expected to traverse the WireGuard tunnel before leaving the source node. The vulnerability breaks this guarantee for packets originating from a terminating endpoint, defined as a pod that is shutting down or being removed from the cluster. Due to a race condition in the datapath, some of these packets can bypass the WireGuard interface and leave the node without encryption. Observers with access to the underlying network can capture the exposed workload traffic. The issue is classified as an information disclosure with confidentiality impact only, since no data modification or availability loss occurs.

Root Cause

The root cause is a synchronization defect between endpoint termination handling and the packet forwarding path that selects the WireGuard tunnel. When an endpoint enters the terminating state, the eBPF policy and encryption state can be updated in an order that lets in-flight packets skip the encryption redirect. The condition maps to [CWE-362], and the resulting cleartext transmission maps to [CWE-319]. The fix, delivered in Cilium pull request 38592, adjusts the datapath so terminating endpoint traffic remains bound to the WireGuard path.

Attack Vector

Exploitation does not require authentication or user interaction, but the attacker must be positioned on the network path between Cilium nodes to observe cleartext traffic. The race condition is timing-dependent and tied to endpoint termination events, which raises attack complexity. There is no code execution or privilege escalation vector; the impact is limited to the confidentiality of packets that should have been encrypted. See the Cilium GitHub Security Advisory GHSA-5vxx-c285-pcq4 for the maintainers' technical description.

Detection Methods for CVE-2025-32793

Indicators of Compromise

Cleartext pod-to-pod traffic captured on the underlying node network when WireGuard transparent encryption is enabled.
Packets on the physical or overlay interface using pod CIDR source or destination addresses instead of the WireGuard peer addresses.
Correlation between pod termination events and observed unencrypted flows leaving a node.

Detection Strategies

Run cilium status and cilium encrypt status on each node to confirm the running Cilium version and WireGuard state.
Perform packet captures on node egress interfaces during pod churn and verify that only WireGuard UDP traffic on port 51871 (default) is observed for inter-node pod communication.
Inventory Cilium releases across clusters and flag any deployment on 1.15.0–1.15.15, 1.16.0–1.16.8, or 1.17.0–1.17.2 using WireGuard encryption.

Monitoring Recommendations

Alert on Kubernetes pod termination events correlated with unexpected cleartext flows on node interfaces.
Track Cilium agent version drift across the fleet and generate findings when nodes run vulnerable releases.
Continuously validate encryption posture using Hubble flow logs and network telemetry rather than assuming configuration equals enforcement.

How to Mitigate CVE-2025-32793

Immediate Actions Required

Upgrade Cilium to 1.15.16, 1.16.9, or 1.17.3 or later, matching the currently deployed minor version.
Audit clusters that rely on WireGuard transparent encryption to confirm no vulnerable agents remain after rollout.
Treat inter-node network segments as untrusted until patched, and restrict access to node interfaces and span ports.

Patch Information

The Cilium maintainers fixed the race condition in releases 1.15.16, 1.16.9, and 1.17.3. The remediation is delivered through Cilium pull request 38592 and documented in GHSA-5vxx-c285-pcq4. Upgrading the Cilium agent and operator to a fixed release is the only supported remediation.

Workarounds

No workarounds are available. The Cilium security advisory states that upgrading is the sole path to remediation.
Compensating controls such as network-layer encryption (for example, IPsec at the underlay) can reduce exposure until the patch is deployed.

bash

# Upgrade Cilium via Helm to a fixed release (choose the matching minor version)
helm repo update
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --version 1.17.3 \
  --reuse-values

# Verify the running version and WireGuard status on each node
kubectl -n kube-system exec ds/cilium -- cilium version
kubectl -n kube-system exec ds/cilium -- cilium encrypt status