products / cilium

Cilium

Cilium is an eBPF-based networking, observability, and security platform for Kubernetes (CNCF). It provides cluster networking, network policy enforcement, and ingress/gateway APIs below application runtimes. NVD tracks it as cilium:cilium with semver-style version ranges across concurrent minor trains.

api usage

Querying Cilium

product slugcilium

version format1.17.17, 1.13.0, 1.12.8

bash

curl "https://api.attestd.io/v1/check?product=cilium&version=1.13.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Cilium 1.13.0 matches CVE-2023-27595 (short startup window applies incorrect network policy). The sample response also surfaces CVE-2023-29002 for this version range and shows a non- none risk_state.

json

{
  "product": "cilium",
  "version": "1.13.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "1.17.17",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-27593",
    "CVE-2023-27594",
    "CVE-2023-27595",
    "CVE-2023-29002",
    "CVE-2023-30851",
    "CVE-2023-34242",
    "CVE-2023-39347",
    "CVE-2023-41332",
    "CVE-2023-41333",
    "CVE-2024-28249",
    "CVE-2024-28860",
    "CVE-2024-37307",
    "CVE-2024-42488",
    "CVE-2025-32793",
    "CVE-2025-64715",
    "CVE-2026-33726",
    "CVE-2026-41520",
    "CVE-2026-49445",
    "CVE-2026-56742"
  ],
  "cves": null,
  "max_epss": 0.00734,
  "last_updated": "2026-07-18T00:10:08.552309Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Cilium 1.17.17 sits past the CVE-2023-27595 and CVE-2023-39347 policy fixes on the 1.13 and 1.14 trains.

bash

curl "https://api.attestd.io/v1/check?product=cilium&version=1.17.17" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Cilium CVEs concentrate on network policy correctness, privilege boundaries between pod and host, and CiliumNetworkPolicy admin scope. Policy bypass issues matter most on multi-tenant clusters where Cilium is the enforcement layer. Version 1.13.0 is the exact release that introduced CVE-2023-27595.

CVE	Description	Affects	CVSS
`CVE-2023-27595`	Short startup window in 1.13.0 applies incorrect network policy and bypasses intended denial rules.	1.13.0	9.8
`CVE-2023-39347`	Pod-label updates cause Cilium to incorrectly allow traffic that policy should deny.	<1.12.14 / ≥1.13 <1.13.7 / ≥1.14 <1.14.2	9.0
`CVE-2022-29179`	Container escape or host access path via Cilium privilege boundary failure.	<1.9.16 / ≥1.10 <1.10.11 / ≥1.11 <1.11.5	8.2
`CVE-2023-41333`	Create or modify CiliumNetworkPolicy escalates beyond intended admin boundaries.	branch cuts	8.1

data sources

Cilium CPE namespace

NVD records Cilium under a single application CPE. Attestd maps the cilium product slug to that namespace and evaluates concurrent minor-train ranges.

cpe:2.3:a:cilium:ciliumCNI, policy, and dataplane

Query the Cilium agent or operator image tag your cluster runs. Hubble UI and other satellite components are not separate Attestd product slugs.

All products Calico Istio Quickstart