What is CVE-2026-25804?

CVE-2026-25804 is a high-severity improper authentication vulnerability in antrea.io/antrea (go), affecting versions < 2.3.2. It is fixed in 2.3.2, 2.4.3. The application does not adequately verify the identity of a user, device, or process before granting access.

Which versions of antrea.io/antrea are affected by CVE-2026-25804?

antrea.io/antrea (go) versions < 2.3.2 is affected.

Is there a fix for CVE-2026-25804?

Yes. CVE-2026-25804 is fixed in 2.3.2, 2.4.3. Upgrade to this version or later.

Is CVE-2026-25804 exploitable, and should I be worried?

Whether CVE-2026-25804 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-25804 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-25804?

Upgrade: antrea.io/antrea to 2.3.2 or later, antrea.io/antrea to 2.4.3 or later.

CVE-2026-25804 in antrea.io/antrea | Intelligent Application Security

Q: Which versions of antrea.io/antrea are affected by CVE-2026-25804?

antrea.io/antrea (go) versions < 2.3.2 is affected.

Q: Is there a fix for CVE-2026-25804?

Yes. CVE-2026-25804 is fixed in 2.3.2, 2.4.3. Upgrade to this version or later.

Q: Is CVE-2026-25804 exploitable, and should I be worried?

Whether CVE-2026-25804 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-25804 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-25804?

Upgrade: antrea.io/antrea to 2.3.2 or later, antrea.io/antrea to 2.4.3 or later.

Summary

Workarounds

Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

For users leveraging Antrea NetworkPolicies, there is no way to fix or remediate the vulnerability without upgrading.

Resources

https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9
https://github.com/antrea-io/antrea/pull/7496
https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md

Impact

Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement.

If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks.

The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot take precedence over rules defined in higher priority Tiers. Some users / roles may only be authorized to define within specific Tiers. This security vulnerability enables such users to intentionally "escape" their Tier and override rules in higher priority Tiers.

Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

Affected versions

antrea.io/antrea (< 2.3.2) antrea.io/antrea (>= 2.4.0, < 2.4.3)

Security releases

antrea.io/antrea → 2.3.2 (go) antrea.io/antrea → 2.4.3 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

See it in your environment

Remediation advice

https://github.com/antrea-io/antrea/pull/7496
Antrea v2.5.0
Antrea v2.4.3
Antrea v2.3.2

Frequently Asked Questions

What is CVE-2026-25804? CVE-2026-25804 is a high-severity improper authentication vulnerability in antrea.io/antrea (go), affecting versions < 2.3.2. It is fixed in 2.3.2, 2.4.3. The application does not adequately verify the identity of a user, device, or process before granting access.
Which versions of antrea.io/antrea are affected by CVE-2026-25804? antrea.io/antrea (go) versions < 2.3.2 is affected.
Is there a fix for CVE-2026-25804? Yes. CVE-2026-25804 is fixed in 2.3.2, 2.4.3. Upgrade to this version or later.
Is CVE-2026-25804 exploitable, and should I be worried? Whether CVE-2026-25804 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-25804 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-25804?
- Upgrade antrea.io/antrea to 2.3.2 or later
- Upgrade antrea.io/antrea to 2.4.3 or later

Other vulnerabilities in antrea.io/antrea

CVE-2026-25804