The vulnerability is an integer overflow in Antrea's network policy priority assignment, which can cause priority calculations to wrap around and produce incorrect OpenFlow priorities. This miscalculation may lead to traffic being allowed or denied contrary to the defined policies, potentially compromising confidentiality, integrity, or availability for services within a Kubernetes cluster. The weakness maps to CWE‑287 (Broken Authentication/Authorization) and CWE‑770 (Out‑of‑Bounds Errors).

Antrea, the Kubernetes native networking solution from the Linux Foundation, is affected when running versions older than 2.3.2 or 2.4.3. Prior to these releases the priority assignment system was vulnerable to a uint16 overflow, which was addressed in release 2.4.3 of Antrea. The vulnerability impacts all clusters that rely on Antrea for policy enforcement.

The vulnerability carries a CVSS score of 8.0, indicating high severity, but the EPSS score is below 1%, suggesting current exploitation probability is low and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires the ability to create or modify many network policies within the cluster or to manipulate priority values so that the 16‑bit counter overflows. Such manipulation could be performed by an insider or a compromised controller, resulting in incorrect traffic enforcement.