CVE-2023-41333

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted `endpointSelector` that uses the `DoesNotExist` operator on the `reserved:init` label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic. This attack requires API server access, as described in the Kubernetes API Server Attacker section of the Cilium Threat Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a workaround an admission webhook can be used to prevent the use of `endpointSelectors` that use the `DoesNotExist` operator on the `reserved:init` label in CiliumNetworkPolicies.

• CWE-306

• https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attackerProduct
• https://github.com/cilium/cilium/pull/28007Issue Tracking, Patch
• https://github.com/cilium/cilium/security/advisories/GHSA-4xp2-w642-7mcxMitigation, Patch, Third Party Advisory
• https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attackerProduct
• https://github.com/cilium/cilium/pull/28007Issue Tracking, Patch
• https://github.com/cilium/cilium/security/advisories/GHSA-4xp2-w642-7mcxMitigation, Patch, Third Party Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41328Frappe is a low code web framework written in Python and Jav…7.5
• CVE-2023-41329WireMock is a tool for mocking HTTP services. The proxy mode…6.6
• CVE-2023-4133A use-after-free vulnerability was found in the cxgb4 driver…5.5
• CVE-2023-41330knplabs/knp-snappy is a PHP library allowing thumbnail, snap…9.8
• CVE-2023-41331SOFARPC is a Java RPC framework. Versions prior to 5.11.0 ar…9.8
• CVE-2023-41332Cilium is a networking, observability, and security solution…3.5
• CVE-2023-41334Astropy is a project for astronomy in Python that fosters in…8.4
• CVE-2023-41335Synapse is an open-source Matrix homeserver written and main…3.7
• CVE-2023-41336ux-autocomplete is a JavaScript Autocomplete functionality f…6.5
• CVE-2023-41337h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …6.7
• CVE-2023-41338Fiber is an Express inspired web framework built in the go l…5.3
• CVE-2023-41339GeoServer is an open source software server written in Java …5.3