The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the     container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port     as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the     destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted     on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port.
    This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is     fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does     not have this vulnerability. (CVE-2025-67499)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c67591d0a2 advisory.

    Automatic update for containernetworking-plugins-1.9.0-1.fc44.

    ##### **Changelog**

    ```
    * Tue Dec  9 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 1.9.0-1
    - Update to release v1.9.0
    - Resolves: rhbz#2420515
    - Resolves CVE-2025-58188: rhbz#2411454, rhbz#2411189, rhbz#2410923
    - Resolves CVE-2025-58185: rhbz#2410556, rhbz#2410277, rhbz#2409991
    - Resolves CVE-2025-61723: rhbz#2409605, rhbz#2409325, rhbz#2409043
    - Resolves CVE-2025-58189: rhbz#2408135, rhbz#2407858, rhbz#2407588
    - Fixes CVE-2025-67499, a bug in the nftables backend for the portmap       plugin
    - Additional changes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the
    container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port
    as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the
    destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted
    on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port.
    This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is
    fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does
    not have this vulnerability. (CVE-2025-67499)

ID	Name	Product	Family	Type	Severity
278373	Linux Distros Unpatched Vulnerability : CVE-2025-67499	Nessus	Misc.	Local	low
278132	Fedora 44 : containernetworking-plugins (2025-c67591d0a2)	Nessus	Fedora Local Security Checks	Local	medium
436320	SCA: security update for github.com/containernetworking/plugins (GHSA-jv3w-x3r3-g6rm)	Tenable Cloud Security	SCA Checks	Local	low
436320	SCA: security update for github.com/containernetworking/plugins (GHSA-jv3w-x3r3-g6rm)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-67499

low

Tenable Plugins

low

medium

low

low