CVE-2026-34992
Published: 06 April 2026
Summary
CVE-2026-34992 is a high-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Linuxfoundation Antrea. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 1.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2026-34992 is a missing encryption vulnerability in Antrea, a Kubernetes-native networking solution. In versions prior to 2.4.5 and 2.5.2, the issue affects inter-node Pod traffic in clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec). While IPv4 Pod traffic is properly encrypted using ESP (Encapsulating Security Payload), IPv6 Pod traffic is transmitted in plaintext because encapsulated packets (using Geneve or VXLAN) bypass the IPsec encryption layer. Single-stack IPv4 or IPv6 clusters are unaffected. The vulnerability is rated 7.5 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-311 (Missing Encryption of Sensitive Data).
Any network attacker with access to the traffic path between Antrea nodes can exploit this vulnerability by passively eavesdropping on IPv6 Pod traffic, potentially exposing sensitive data that users expected to be protected by IPsec. No authentication, privileges, or user interaction is required, making it straightforward for remote attackers on shared networks or those who can intercept underlay traffic. The impact is limited to high confidentiality loss, with no integrity or availability effects.
Antrea addresses this vulnerability in releases 2.4.5 and 2.5.2. The official security advisory (GHSA-qcmw-8mm4-4p28) and related pull requests (#7757, #7759) detail the fixes, including commits like 738bad662b20a5d358d19466936176ef580a9b07. Users should upgrade to these patched versions and review the traffic encryption documentation for proper IPsec configuration in dual-stack environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19368
Vulnerability details
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Pod traffic. In Antrea clusters configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec), Antrea fails to…
more
apply encryption for IPv6 Pod traffic. While the IPv4 traffic is correctly encrypted via ESP (Encapsulating Security Payload), traffic using IPv6 is transmitted in plaintext. This occurs because the packets are encapsulated (using Geneve or VXLAN) but bypass the IPsec encryption layer. Impacted Users: users with dual-stack clusters and IPsec encryption enabled. Single-stack IPv4 or IPv6 clusters are not affected. This vulnerability is fixed in 2.4.5 and 2.5.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing IPsec encryption for IPv6 Pod traffic directly enables passive network sniffing to capture sensitive data in plaintext on the underlay network path.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates protection of the confidentiality of transmitted inter-node Pod traffic, directly addressing the plaintext transmission of IPv6 traffic despite IPsec configuration.
Requires implementation of cryptographic protections for data in transit, mitigating the IPsec encryption bypass for IPv6 Pod traffic in dual-stack Antrea clusters.
Provides for identification, reporting, and correction of software flaws like the Antrea encryption vulnerability, enabling timely patching to versions 2.4.5 or 2.5.2.