An information exposure vulnerability in Cilium allows local, highly privileged attackers to harvest sensitive data from diagnostic bug tool outputs when WireGuard encryption is enabled.

This issue is classified as an exposure of sensitive information caused by improper handling of diagnostic data collection. The attack requires local access with high privileges and no user interaction.

A successful exploit could lead to the unauthorized exposure of sensitive cryptographic or networking secrets contained within diagnostic logs, compromising the confidentiality of secure communications. Although the CVSS score is 7.9, placing it in the high severity range, the requirement for high privileges limits the attack surface primarily to compromised administrative accounts or malicious insiders.

Immediate Action: Update Cilium to version 1.17.15, 1.18.9, 1.19.3, or later depending on the active deployment stream.

Proactive Monitoring: Review access logs for diagnostic tool executions and audit permissions for accounts capable of running administrative debugging utilities.

Compensating Controls: Restrict execution privileges for diagnostic tools to trusted personnel only until the software update can be applied.

Public Exploit Available: false

Administrators managing Kubernetes clusters with WireGuard encryption enabled should prioritize applying the updated Cilium releases. Ensuring that diagnostic utilities are executed only by trusted administrative staff mitigates the risk of unauthorized information disclosure.