CVE-2025-67499The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container.
Updated under an hour ago ()
Does this affect you?
It affects linuxfoundation cni_network_plugins. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
- CVSS
- 3.6 LOW (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-200
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
linuxfoundation cni_network_plugins linuxfoundation:cni_network_plugins | from 1.6.0 before 1.9.0 | NVD |
References
- https://github.com/containernetworking/plugins/pull/1210issue-tracking, patch
- https://github.com/containernetworking/plugins/releases/tag/v1.9.0product, release-notes
- https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rmvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.