CVE-2025-23047
📋 TL;DR
CVE-2025-23047 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in Cilium's Hubble UI that allows malicious websites to access sensitive Kubernetes cluster configuration data. Affected users are those running vulnerable Cilium versions with Hubble UI deployed via Cilium CLI or Helm chart. The vulnerability requires a victim to visit a malicious page while having access to Hubble UI.
💻 Affected Systems
- Cilium
📦 What is this software?
Cilium by Cilium
Cilium by Cilium
Cilium by Cilium
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate complete Kubernetes cluster configuration including node names, IP addresses, workload metadata, and network configuration, enabling further attacks against the cluster infrastructure.
Likely Case
Limited data exposure of cluster metadata that could be used for reconnaissance and targeted attacks against specific workloads or nodes.
If Mitigated
No data exposure if Hubble UI is not internet-facing and users follow security best practices for web application access.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious page) and access to Hubble UI. No authentication bypass needed beyond Hubble UI access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Cilium v1.14.18, v1.15.12, v1.16.5
Vendor Advisory: https://github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356
Restart Required: Yes
Instructions:
1. Update Cilium to patched version using your deployment method (Helm, CLI, or operator). 2. Restart Cilium components. 3. Verify Hubble UI is functioning correctly after update.
🔧 Temporary Workarounds
Remove CORS headers from Helm template
linuxManually modify Helm templates to remove vulnerable CORS headers as shown in the security advisory patch
# Apply patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d
# Or manually remove CORS headers from Hubble UI Helm templates
🧯 If You Can't Patch
- Restrict Hubble UI access to trusted networks only using network policies or firewalls
- Implement additional authentication/authorization layers for Hubble UI access
🔍 How to Verify
Check if Vulnerable:
Check Cilium version and Hubble UI deployment method. If using affected versions with Hubble UI via CLI/Helm, you are vulnerable.Check Version:
cilium version | grep -i ciliumVerify Fix Applied:
Verify Cilium version is patched (1.14.18+, 1.15.12+, or 1.16.5+) and test Hubble UI functionality📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests to Hubble UI endpoints
- Multiple failed CORS preflight requests
Network Indicators:
- Cross-origin requests to Hubble UI from unexpected domains
- Sensitive data in cross-origin responses
SIEM Query:
web_access_logs destination_uri="/api/v1/*" AND user_agent CONTAINS "malicious-domain.com" AND status=200