{"cve":"CVE-2023-34242","nvd":{"published":"2023-06-15T20:15:09.473","modified":"2026-06-17T06:03:12.363","status":"Modified","description":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of `ReferenceGrant` resources to admin users by using Kubernetes RBAC.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-200"],"references":["https://github.com/cilium/cilium/releases/tag/v1.13.4","https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6","https://github.com/cilium/cilium/releases/tag/v1.13.4","https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6"],"products":["cilium:cilium"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-34242","score":0.00305,"percentile":0.23327,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-r7wr-4w5q-55m6","url":"https://osv.dev/vulnerability/GHSA-r7wr-4w5q-55m6","summary":"Cilium vulnerable to information leakage via incorrect ReferenceGrant handling","modified":"2026-09-10T03:50:08.433582241Z","packages":[{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium","ranges":[">=1.13.0 <1.13.4"],"fixed":["1.13.4"]}]},{"id":"GO-2023-1862","url":"https://osv.dev/vulnerability/GO-2023-1862","summary":"Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium","modified":"2026-02-04T03:46:16.610915Z","packages":[{"ecosystem":"Go","name":"github.com/cilium/cilium","purl":"pkg:golang/github.com/cilium/cilium","ranges":[">=1.13.0 <1.13.4"],"fixed":["1.13.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}