CVE-2026-25804
📋 TL;DR
This vulnerability in Antrea's network policy priority assignment system causes incorrect traffic enforcement due to a uint16 arithmetic overflow when handling large numbers of policies. Kubernetes clusters using vulnerable Antrea versions may experience unintended network traffic flows. The issue affects Antrea versions prior to 2.3.2 and 2.4.3.
💻 Affected Systems
- Antrea
📦 What is this software?
Antrea by Linuxfoundation
Antrea by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Network policies fail to enforce correctly, allowing unauthorized traffic between pods or external access to sensitive services, potentially leading to data exfiltration or lateral movement.
Likely Case
Inconsistent network policy enforcement causing intermittent connectivity issues or unintended traffic patterns within the Kubernetes cluster.
If Mitigated
With proper network segmentation and defense-in-depth controls, impact is limited to potential policy bypass within the affected Antrea-controlled network segment.
🎯 Exploit Status
Exploitation requires creating enough network policies with specific priority values to trigger the overflow condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.2 or 2.4.3
Vendor Advisory: https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9
Restart Required: Yes
Instructions:
1. Backup current Antrea configuration. 2. Update Antrea to version 2.3.2 or 2.4.3 using your Kubernetes package manager. 3. Restart Antrea controller and agent pods. 4. Verify network policies are functioning correctly.
🔧 Temporary Workarounds
Limit Network Policy Count
linuxReduce the number of network policies to avoid triggering the overflow condition
kubectl get networkpolicies --all-namespaces | wc -l
# Monitor policy count and keep below overflow threshold
🧯 If You Can't Patch
- Implement additional network segmentation using host-level firewalls or service mesh solutions
- Deploy network policy validation tools to detect incorrect enforcement
🔍 How to Verify
Check if Vulnerable:
Check Antrea version: kubectl get pods -n kube-system -l app=antrea -o jsonpath='{.items[*].spec.containers[*].image}'Check Version:
kubectl get pods -n kube-system -l app=antrea -o jsonpath='{.items[*].spec.containers[*].image}' | grep -o 'antrea:[0-9.]*'Verify Fix Applied:
Verify version is 2.3.2 or 2.4.3 and test network policy enforcement with traffic tests between pods📡 Detection & Monitoring
Log Indicators:
- Antrea controller logs showing priority calculation errors
- Unexpected OpenFlow rule priority values in Antrea logs
Network Indicators:
- Traffic flowing between pods that should be blocked by network policies
- Inconsistent policy enforcement across similar workloads
SIEM Query:
source="antrea" AND ("priority overflow" OR "OpenFlow priority" AND error)