CVE-2024-42486

Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway resources being able to access secrets for longer than intended, or to Routes having the ability to forward traffic to backends in other namespaces for longer than intended. This issue has been patched in Cilium v1.15.8 and v1.16.1. As a workaround, any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster.

Category

5.4
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.03%
Affected: cilium cilium
Published at:
Updated at:

References

Link Tags
https://github.com/cilium/cilium/security/advisories/GHSA-vwf8-q6fw-4wcm
https://github.com/cilium/cilium/pull/34032
https://github.com/cilium/cilium/commit/ed3dfa0aab8b80f7e841a6d49d2a990ac2dca053

Frequently Asked Questions

What is the severity of CVE-2024-42486?
CVE-2024-42486 has been scored as a medium severity vulnerability.
How to fix CVE-2024-42486?
To fix CVE-2024-42486, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-42486 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-42486 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-42486?
CVE-2024-42486 affects cilium cilium.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.