Cilium Tetragon unauthenticated admin API exposed to hostNetwork pods
A container security tool can be reached without a lock, letting attackers take control.
Summary
Tetragon's gRPC admin API is reachable without authentication over a TCP listener, so an attacker running or controlling hostNetwork pods on the same node can escalate privileges or escape a container. Versions before 1.7.0 are affected, and the Helm default causes it.
Affected when
- Helm default install exposing an unauthenticated TCP listener
- attacker can run or compromise hostNetwork pods on the same node
What to do
Update to version 1.7.0 or later. The sources give no stopgap.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen