CVE-2025-67499

The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.

• CWE-200

• https://github.com/containernetworking/plugins/pull/1210Issue Tracking, Patch
• https://github.com/containernetworking/plugins/releases/tag/v1.9.0Product, Release Notes
• https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rmVendor Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67493Homarr is an open-source dashboard. Prior to version 1.45.3,…9
• CVE-2025-67494ZITADEL is an open-source identity infrastructure tool. Vers…8.6
• CVE-2025-67495ZITADEL is an open-source identity infrastructure tool. Vers…6.1
• CVE-2025-67496WeGIA is an open source Web Manager for Institutions with a …5.4
• CVE-2025-67497Rejected reason: Further research determined the issue is no…
• CVE-2025-67498Rejected reason: Further research determined the issue is no…
• CVE-2025-6750A vulnerability, which was classified as problematic, has be…3.3
• CVE-2025-67500Mastodon is a free, open-source social network server based …3.7
• CVE-2025-67501WeGIA is an open source Web Manager for Institutions with a …8.8
• CVE-2025-67502Taguette is an open source qualitative research tool. In ver…6.1
• CVE-2025-67503Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-67504WBCE CMS is a content management system. Versions 1.6.4 and …9.8