CVE-2025-67499

Name of the Vulnerable Software and Affected Versions CNI portmap plugin versions 1.6.0 through 1.8.0

Description The CNI portmap plugin flaw allows containers to intercept traffic not intended for the node. This occurs when the plugin is configured with the nftables backend, inadvertently forwarding all traffic with the same destination port as the host port, regardless of the destination IP address. Containers requesting HostPort forwarding can intercept all traffic destined for that port. This requires explicit configuration of the portmap plugin to use the nftables backend.

Recommendations Configure the portmap plugin to use the iptables backend for versions 1.6.0 through 1.8.0. Update to version 1.9.0 for versions 1.6.0 through 1.8.0.