CVE-2026-25804: Antrea has invalid enforcement order for network policy rules caused by integer overflow

Published Feb 6, 2026
·
Updated

Impact

Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement.

If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks.

The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot take precedence over rules defined in higher priority Tiers. Some users / roles may only be authorized to define within specific Tiers. This security vulnerability enables such users to intentionally "escape" their Tier and override rules in higher priority Tiers.

Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

Patches https://github.com/antrea-io/antrea/pull/7496 Antrea v2.5.0 Antrea v2.4.3 Antrea v2.3.2

Workarounds

Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

For users leveraging Antrea NetworkPolicies, there is no way to fix or remediate the vulnerability without upgrading.

Resources

https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9 https://github.com/antrea-io/antrea/pull/7496 https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md

Other sources

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.

MITRE

Affected Software

4 affected componentsFixes available
go/antrea.io/antrea>=2.4.0<2.4.3
2.4.3
go/antrea.io/antrea<2.3.2
2.3.2
linuxfoundation Antrea Kubernetes<2.3.2
linuxfoundation Antrea Kubernetes>=2.4.0<2.4.3

Event History

Feb 6, 2026
Advisory Published
via GitHub·10:36 PM
Data Sourced
via GitHub·10:36 PM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·10:58 PM
Data Sourced
via MITRE·10:58 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
RemedyAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-25804?

CVE-2026-25804 is classified as a medium severity vulnerability due to its potential impact on network policy enforcement.

2

How do I fix CVE-2026-25804?

To fix CVE-2026-25804, update Antrea to version 2.4.3 or later, or to version 2.3.2 if you are using an older release.

3

What impact does CVE-2026-25804 have on network policy rules?

CVE-2026-25804 causes incorrect OpenFlow priority calculations, leading to invalid enforcement of network policy rules.

4

Which versions of Antrea are affected by CVE-2026-25804?

CVE-2026-25804 affects Antrea versions from 2.4.0 up to 2.4.3 and versions up to 2.3.2.

5

Is there a workaround for CVE-2026-25804 if I cannot upgrade?

Currently, there are no known workarounds for CVE-2026-25804, and upgrading is recommended to mitigate the risk.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203