The vulnerability in CiliumNetworkPolicy arises when egress policies use toGroups.aws.securityGroupsIds referencing AWS security group IDs that either do not exist or are not attached to any network interface. In such cases, the derived policy fails to generate the toCIDRset section, resulting in potentially unrestricted outbound traffic beyond what the policy author intended. This issue affects Cilium versions >=1.18.0 <1.18.4, >=1.17.0 <1.17.10, and all versions below 1.16.17. Official patches have been released in versions 1.18.4, 1.17.10, and 1.16.17 to fix this behavior.

The vulnerability can lead to unintended broader outbound network access due to missing toCIDRset entries in the egress policy, potentially allowing traffic to destinations not authorized by the original policy. This undermines the intended network segmentation and security controls enforced by CiliumNetworkPolicy egress rules. There is no indication of impact on confidentiality, integrity, or availability beyond the broader egress access.

This vulnerability is officially patched in Cilium versions 1.18.4, 1.17.10, and 1.16.17. Users should upgrade to these or later versions to remediate the issue. There are no available workarounds. Review and correct any egress policies referencing AWS security group IDs to ensure they reference valid and attached security groups.