Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/containernetworking/plugins

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.6GoPublished

    CNA Plugins Portmap nftables backend can intercept non-local traffic

    CVE-2025-67499 · GHSA-jv3w-x3r3-g6rm

    Affected
    • Go github.com/containernetworking/plugins >= 1.6.0, < 1.9.0
    Fixed in
    1.9.0· Vendor fix available
    Issue
    Background The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. For example, if a host has the IP 198.51.100.42, a container may request that all packets to 198.51.100.42:53 be forwarded to the container's network. Vulnerability When the portmap plugin is configured with the nftables backend, it inadvertently forwards all traffic with the same destination port as the host port, ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. In the given example above, traffic destined to port 53 but for a separate container would still be captured and forwarded, even though it was not destined for the host. Impact Containers (i.e. kubernetes pods) that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. (The iptables backend is the…

    Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.0GoPublished

    containernetworking/plugins vulnerable to MitM attacks

    CVE-2020-10749 · GHSA-fx6x-h9g4-56f8

    Affected
    • Go github.com/containernetworking/plugins < 0.8.6
    Fixed in
    0.8.6· Vendor fix available
    Issue
    A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

    Recommended action: Upgrade to 0.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →