Prior to Cilium specific 1.18.x and 1.19.x releases, administrators can create CiliumLocalRedirectPolicies that accept arbitrary ClusterIP addresses via the addressMatcher field. This flaw allows a user with policy‑creation privileges to specify any IP in any namespace, effectively redirecting traffic destined for a Service to an attacker‑controlled endpoint. Deleting such a policy can also corrupt Cilium’s Service. The weaknesses involve unauthorized modification of existing service routing data, reflected by CWE‑863.

The vulnerability exists in the open‑source networking stack Cilium. Affected releases are all versions prior to 1.17.16, versions 1.18.2 through 1.18.9, and 1.19.0 through 1.19.3. Upgrading to 1.17.16, 1.18.10, or 1.19.4 resolves the issue.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector requires the ability to create or delete CiliumLocalRedirectPolicies, which typically demands cluster‑level privileges. An attacker with such authority can hijack cross‑namespace service traffic or cause denial of service by corrupting service translation.