Suse CVE-2026-34992

Antrea cluster configured for dual-stack networking with IPsec encryption enabled (trafficEncryptionMode: ipsec). Attacker with network access to cluster Pod network can intercept IPv6 inter-Pod traffic transmitted in plaintext. IPv4 traffic correctly encrypted; only IPv6 traffic affected.

Real-world risk is moderate and highly dependent on deployment context. Without CVSS scoring or EPSS probability data, assessment relies on environmental factors and technical impact analysis. The vulnerability requires specific preconditions: dual-stack cluster configuration with IPsec enabled, which narrows the affected population to organizations running modern IPv6-enabled Kubernetes infrastructure. Attack complexity is low once preconditions are met-passive network sniffing requires no authentication or user interaction. The primary impact is confidentiality loss through plaintext exposure of inter-Pod IPv6 traffic, which may contain application data, service mesh communications, or microservice API calls. Exploitation is not automatable in the SSVC sense (requires positioned network access), and no active exploitation is confirmed via CISA KEV. However, the silent failure mode is concerning: administrators believe traffic is encrypted when it is not, creating a false sense of security. Priority should be elevated for multi-tenant clusters, environments with compliance requirements (PCI-DSS, HIPAA), or networks where adversaries may have physical or virtualization-layer access to monitor traffic. Single-stack deployments face no risk, and the availability of patches across three release branches with a validation tool significantly reduces remediation burden.

An attacker with network access between Kubernetes nodes in a dual-stack Antrea cluster (such as a compromised VM on the same hypervisor, access to network infrastructure, or lateral movement within a cloud VPC) uses packet capture tools like tcpdump or Wireshark to monitor inter-node traffic. While IPv4 Pod communications appear as encrypted ESP packets, the attacker observes that IPv6 traffic is transmitted in plaintext within Geneve or VXLAN encapsulation. By filtering for IPv6 packets, the attacker can read application payloads, API tokens, database queries, or other sensitive data exchanged between microservices, bypassing the intended encryption security control without triggering detection mechanisms that assume all inter-Pod traffic is encrypted.