Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34992Missing Encryption of Sensitive Data in antrea.io/antrea

High 7.1

In plain English

A high-severity security flaw in antrea from antrea-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.1%top 97.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Goantrea.io/antreano fix listedGHSA-qcmw-8mm4-4p28
Goantrea.io/antreano fix listedGHSA-qcmw-8mm4-4p28
Goantrea.io/antrea1.11.0-alpha.0.0.20260225185322-738bad662b20GHSA-qcmw-8mm4-4p28
Goantrea.io/antreano fix listedGO-2026-5579
Goantrea.io/antrea1.11.0-alpha.0.0.20260225185322-738bad662b20GO-2026-5579
Goantrea.io/antreano fix listedGO-2026-5579

Affected products (as reported)

VendorProductVersions
antrea-io antrea < 2.4.5>= 2.5.0, < 2.5.2

Weakness: CWE-311 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References