Medium 6.6Published Dec 9, 2025

CVE-2025-67499CNI Plugins Portmap nftables backend intercepts non-local traffic

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects containernetworking plugins and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for containernetworking plugins

Exploited in the last 30 days

The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.

CVSS: 6.6 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness (CWE): CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Dec 10, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

containernetworking plugins containernetworking:plugins (from the name)	from 1.6.0, < 1.9.0	CNA record
linuxfoundation cni_network_plugins linuxfoundation:cni_network_plugins	from 1.6.0 before 1.9.0	NVD

References

References

https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rm	x-refsource-confirm, vendor-advisory
https://github.com/containernetworking/plugins/pull/1210	x-refsource-misc, issue-tracking, patch
https://github.com/containernetworking/plugins/releases/tag/v1.9.0	x-refsource-misc, product, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.