CVE-2026-34992

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34992
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md Patch Product
https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07 Patch
https://github.com/antrea-io/antrea/pull/7757 Issue Tracking Patch
https://github.com/antrea-io/antrea/pull/7759 Issue Tracking Patch
https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*
cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*
History

27 Apr 2026, 23:51

Type Values Removed Values Added
CPE cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*
First Time Linuxfoundation
Linuxfoundation antrea
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md - () https://github.com/antrea-io/antrea/blob/main/docs/traffic-encryption.md - Patch, Product
References () https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07 - () https://github.com/antrea-io/antrea/commit/738bad662b20a5d358d19466936176ef580a9b07 - Patch
References () https://github.com/antrea-io/antrea/pull/7757 - () https://github.com/antrea-io/antrea/pull/7757 - Issue Tracking, Patch
References () https://github.com/antrea-io/antrea/pull/7759 - () https://github.com/antrea-io/antrea/pull/7759 - Issue Tracking, Patch
References () https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28 - () https://github.com/antrea-io/antrea/security/advisories/GHSA-qcmw-8mm4-4p28 - Patch, Vendor Advisory

06 Apr 2026, 17:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-06 17:17

Updated : 2026-04-27 23:51

NVD link : CVE-2026-34992

Mitre link : CVE-2026-34992

CVE.ORG link : CVE-2026-34992

JSON object : View

Products Affected

linuxfoundation

  • antrea
CWE
CWE-311

Missing Encryption of Sensitive Data