CVE-2025-67499: CNI Plugins Portmap nftables backend intercepts non-local traffic
Background
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. For example, if a host has the IP 198.51.100.42, a container may request that all packets to 198.51.100.42:53 be forwarded to the container's network.
Vulnerability
When the portmap plugin is configured with the nftables backend, it inadvertently forwards all traffic with the same destination port as the host port, ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node.
In the given example above, traffic destined to port 53 but for a separate container would still be captured and forwarded, even though it was not destined for the host.
Impact
Containers (i.e. kubernetes pods) that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. (The iptables backend is the default.)
Patches This is fixed as of CNI plugins v1.9.0
Workarounds Configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
Other sources
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67499?
CVE-2025-67499 has been classified with a high severity due to its potential for exploitation in container environments.
How do I fix CVE-2025-67499?
To mitigate CVE-2025-67499, update the CNI `portmap` plugin to version 1.9.0 or later.
What systems are affected by CVE-2025-67499?
CVE-2025-67499 affects the CNI `portmap` plugin versions between 1.6.0 and 1.9.0.
What are the risks associated with CVE-2025-67499?
Exploitation of CVE-2025-67499 could allow unauthorized access to sensitive network communication within containerized environments.
Is there any workaround for CVE-2025-67499 before applying a fix?
Currently, the only recommended workaround for CVE-2025-67499 is to upgrade to a non-vulnerable version of the CNI `portmap` plugin.