CVE-2025-67499: 
Docker vulnerability analysis and mitigation

CVE-2025-67499 is a traffic interception vulnerability in the CNI portmap plugin's nftables backend that allows containers to intercept network traffic not intended for them. It affects CNI network plugins versions 1.6.0 through 1.8.0 (exclusive of 1.9.0) when explicitly configured to use the nftables backend. The vulnerability was disclosed on December 9, 2025, via a GitHub Security Advisory. The CVSS v3.1 score from the GitHub Advisory is 6.6 (Moderate), though NVD records a lower score of 3.6 (Low) (Github Advisory, GitHub Security Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) lies in how the nftables backend implemented port forwarding rules. Unlike the iptables backend, which uses -m addrtype --dst-type LOCAL to restrict forwarding to traffic destined for the local host, the nftables backend used two separate chains (hostip_hostports and hostports) without applying a fib daddr type local check in the prerouting hook for the hostports chain. This omission caused the plugin to forward all traffic matching the destination port — regardless of destination IP — to the requesting container, including traffic intended for other containers on the same node. The fix (commit 9b3772e) introduces an intermediate chain hostports_all and adds the fib daddr type local check in both the prerouting and output hooks before jumping to port-forwarding rules (GitHub Security Advisory, Fix Commit).

A low-privileged container (e.g., a Kubernetes pod) that requests HostPort forwarding can intercept all traffic destined for the configured port on the node, including traffic intended for other containers. This enables unauthorized access to sensitive data in transit (confidentiality impact), potential modification of intercepted traffic (integrity impact), and disruption of legitimate services that fail to receive their intended traffic (availability impact). The vulnerability is scoped to environments explicitly configured to use the nftables backend, which is not the default (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires local access with low privileges — specifically, the ability to deploy a container requesting HostPort forwarding on a node where the portmap plugin is explicitly configured to use the nftables backend. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target environment: Confirm the target Kubernetes cluster or container runtime uses CNI network plugins versions 1.6.0–1.8.0 with the portmap plugin explicitly configured to use the nftables backend (non-default configuration).
2. Deploy a malicious container: Create a Kubernetes pod or container that requests HostPort forwarding on a commonly used port (e.g., port 53 for DNS, port 80 for HTTP) via the pod spec's hostPort field.
3. Trigger traffic interception: Once the pod is scheduled on a vulnerable node, the nftables rules created by the portmap plugin will forward all traffic arriving at that port — regardless of destination IP — to the attacker's container, including traffic intended for other containers on the same node.
4. Capture and analyze traffic: Use packet capture tools (e.g., tcpdump) inside the container to read intercepted traffic, potentially exposing credentials, session tokens, or other sensitive data from co-located workloads (GitHub Security Advisory, Fix PR).

• Network: Unexpected traffic redirection on a node where containers are receiving packets not addressed to their host IP; anomalous traffic volumes on ports configured as HostPorts.
• nftables Rules: Presence of nftables rules in the cni_hostport table lacking fib daddr type local checks in the prerouting or output chains (e.g., rules jumping directly to hostports or hostip_hostports without a local address type filter).
• Logs: Container runtime logs showing HostPort forwarding requests from pods on nodes using the nftables backend; unexpected DNS or service traffic appearing in container logs for workloads that should not be receiving it.
• File System: CNI configuration files in /etc/cni/net.d/ specifying "backend": "nftables" for the portmap plugin on affected plugin versions (GitHub Security Advisory).

Upgrade CNI network plugins to version 1.9.0 or later, which includes the fix that adds the fib daddr type local check to prevent non-local traffic interception (Github Advisory). As an immediate workaround, configure the portmap plugin to use the iptables backend instead of nftables — the iptables backend is the default and does not have this vulnerability. Fedora and SUSE have issued updated packages for their distributions (Linux Security Fedora). Red Hat has also acknowledged the vulnerability (Red Hat CVE).

The vulnerability was reported by security researcher agusdallalba and remediated by champtar (Etienne Champetier), with the fix merged into the main branch on November 13, 2025, prior to the public disclosure on December 9, 2025 (Fix PR). Red Hat acknowledged the issue and published a CVE entry (Red Hat CVE). Fedora and SUSE issued updated packages shortly after disclosure. No significant broader media coverage or social media discussion has been observed beyond standard vulnerability tracking feeds.