Between Cilium releases 1.19.0 through 1.19.4, a policy parsing bug caused selectorless CIDR‑based ipBlock rules to create an unintended pod selector when a custom clusterName was configured. This resulted in the policy engine incorrectly permitting traffic from any pod in the same namespace as the policy subject, effectively lifting the intended isolation of the NetworkPolicy. The flaw does not provide arbitrary code execution or host compromise but expands the potential attack surface inside the cluster, raising a confidentiality and integrity risk for intra‑namespace services.

Cilium, version 1.19.0 to 1.19.4, configured with a custom clusterName and NetworkPolicies that use selectorless ipBlock specifications. Versions 1.19.5 and later contain the fix; other Cilium releases remain unaffected.

An attacker must be able to create or modify a NetworkPolicy object that includes a selectorless ipBlock while the cluster is running a non‑default clusterName. Once the policy is applied, the bug causes the engine to allow traffic from any pod in that namespace, exposing intra‑namespace services to unintended workloads. The EPSS score is below 1 %, indicating a very low probability of exploitation, and the CVE is not listed in CISA KEV. The vulnerability is therefore moderate in severity (CVSS 5.4) and best addressed through patching and configuration review.