Cni Network Plugins CVE-2025-67499

The Container Networking Interface (CNI) portmap plugin is a network plugin that enables containers to request host port forwarding, mapping a port on the host to a port within the container. The vulnerability exists specifically in the nftables backend implementation (an alternative to iptables for netfilter packet filtering rules) used to configure these port-forwarding rules. When nftables processes outbound and inbound traffic, the buggy rule configuration matches traffic based solely on the destination port number without also matching on the destination IP address, causing the filter to overmatch and intercept traffic that should transit through the node to other containers. The root cause is classified as CWE-200 (Information Exposure), though the vulnerability also enables traffic interception and potential disruption. The affected product is the Linux Foundation's CNI Network Plugins (cpe:2.3:a:linuxfoundation:cni_network_plugins), which are fundamental to Kubernetes and other container orchestration systems.