CVE-2026-34992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34992", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-31T19:38:31.618Z", "datePublished": "2026-04-06T16:31:39.224Z", "dateUpdated": "2026-04-07T14:10:53.588Z"}, "containers": {"cna": {"title": "Missing Encryption of Sensitive Data in antrea.io/antrea", "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "lang": "en", "description": "CWE-311: Missing Encryption of Sensitive Data", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28"}, {"name": "https://github.com/antrea-io/antrea/pull/7757", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/pull/7757"}, {"name": "https://github.com/antrea-io/antrea/pull/7759", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/pull/7759"}, {"name": "https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07"}, {"name": "https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md"}], "affected": [{"vendor": "antrea-io", "product": "antrea", "versions": [{"version": "< 2.4.5", "status": "affected"}, {"version": ">= 2.5.0, < 2.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T16:31:39.224Z"}, "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2."}], "source": {"advisory": "GHSA-qcmw-8mm4-4p28", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:10:43.927210Z", "id": "CVE-2026-34992", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:10:53.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Missing Encryption of Sensitive Data in antrea.io/antrea", "source": {"advisory": "GHSA-qcmw-8mm4-4p28", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "ADJACENT", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "antrea-io", "product": "antrea", "versions": [{"status": "affected", "version": "< 2.4.5"}, {"status": "affected", "version": ">= 2.5.0, < 2.5.2"}]}], "references": [{"url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28", "name": "https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/antrea-io/antrea/pull/7757", "name": "https://github.com/antrea-io/antrea/pull/7757", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/antrea-io/antrea/pull/7759", "name": "https://github.com/antrea-io/antrea/pull/7759", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07", "name": "https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md", "name": "https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311: Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T16:31:39.224Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:10:43.927210Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-07T14:10:49.715Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-34992", "state": "PUBLISHED", "dateUpdated": "2026-04-06T16:31:39.224Z", "dateReserved": "2026-03-31T19:38:31.618Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T16:31:39.224Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "antrea", "vendor": "antrea-io", "versions": [{"status": "affected", "version": "< 2.4.5"}, {"status": "affected", "version": ">= 2.5.0, < 2.5.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "C7F386FD-A3B0-4514-A068-F2EBE07644F1", "versionEndExcluding": "2.4.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "E08570A1-C455-459D-BA14-94DC70FA5452", "versionEndExcluding": "2.5.2", "versionStartIncluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2."}], "id": "CVE-2026-34992", "lastModified": "2026-06-17T10:39:57.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34992", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:10:43.927210Z", "version": "2.0.3"}}]}, "published": "2026-04-06T17:17:12.183", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/antrea-io/antrea/pull/7757"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/antrea-io/antrea/pull/7759"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,2.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.5.0,2.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "antrea", "source": "cna", "vendor": "antrea-io"}, "product": "antrea", "vendor": "antrea-io"}], "analysis": {"en": {"generated_at": "2026-04-06T19:35:45.964474+00:00", "value": {"mitigation_remediation": ["Update Antrea to version 2.4.5 or newer (2.5.2+ for branch 2.5) to restore IPv6 encryption", "Verify that trafficEncryptionMode remains set to ipsec and that dual\u2011stack nodes correctly use ESP for both families", "Monitor inter\u2011node traffic for any plaintext IPv6 packets as a check after patching"], "summary": {"action": "Immediate Patch", "impact": "Data exposure for IPv6 inter-node traffic in dual\u2011stack Antrea clusters"}, "threat_synthesis": {"affected_systems": "The affected product is Antrea from antrea\u2011io. Versions prior to 2.4.5 (for branch 2.4) and prior to 2.5.2 (for branch 2.5) are vulnerable when trafficEncryptionMode is set to ipsec on a dual\u2011stack (IPv4/IPv6) cluster. Single\u2011stack IPv4 or IPv6 setups are not impacted.", "description_and_impact": "A flaw in Antrea caused the IPsec encryption layer to be skipped when IPv6 packets were sent between nodes in dual\u2011stack clusters. While IPv4 traffic was wrapped in ESP, IPv6 traffic traversed the network in plaintext. The vulnerability is a classic confidentiality loss that allows an adversary to read sensitive data flowing between pods, potentially enabling additional attacks. The weakness is recorded as CWE\u2011311, indicating a failure to encrypt data during transmission.", "risk_and_exploitability": "The CVSS score of 7.1 signals a high\u2011severity issue that can be exploited from within the cluster or from a network that has visibility into node traffic. EPSS data is unavailable and the vulnerability is not listed in CISA\u2019s KEV catalog, but the risk stems from the fact that the vulnerable traffic is unencrypted. Attackers would need network access to the inter\u2011node channels; once they can capture IPv6 packets, they obtain unencrypted data. No additional exploit conditions are required beyond the presence of a dual\u2011stack IPsec cluster."}}}}, "created": "2026-04-06T20:13:39.545813+00:00", "updated": "2026-04-06T21:31:35.116604+00:00", "vendors": ["antrea-io", "antrea-io$PRODUCT$antrea"]}