CVE-2023-34242

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of `ReferenceGrant` resources to admin users by using Kubernetes RBAC.

• CWE-200

• https://github.com/cilium/cilium/releases/tag/v1.13.4Release Notes
• https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6Third Party Advisory
• https://github.com/cilium/cilium/releases/tag/v1.13.4Release Notes
• https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6Third Party Advisory

Published

Jun 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34237SABnzbd is an open source automated Usenet download tool. A …9.8
• CVE-2023-34238Gatsby is a free and open source framework based on React. T…5.3
• CVE-2023-34239Gradio is an open-source Python library that is used to buil…9.1
• CVE-2023-3424An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2023-34240Cloudexplorer-lite is an open source cloud software stack. W…9.8
• CVE-2023-34241OpenPrinting CUPS is a standards-based, open source printing…7.1
• CVE-2023-34243TGstation is a toolset to manage production BYOND servers. I…5.3
• CVE-2023-34244GLPI is a free asset and IT management software package. Sta…6.1
• CVE-2023-34245@udecode/plate-link is the link handler for the udecode/plat…6.1
• CVE-2023-34246Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.…6.5
• CVE-2023-34247Keystone is a content management system for Node.JS. There i…4.1
• CVE-2023-34249benjjvi/PyBB is an open source bulletin board. Prior to comm…9.8