github.com/cloudnativelabs/kube-router

3 results · Feed

• Medium 6.3
  GHSA-v5mh-h5hx-7v92

  kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

  ## Summary When the kube-router routing controller starts (`--run-router`), it binds the GoBGP gRPC management server to the node's primary IP (e.g., `192.168.1.10:50051`) in addition to `127.0.0.1:50051`. The default admin port is `50051` and the server is e…

  github.com/cloudnativelabs/kube-router/v2 github.com/cloudnativelabs/kube-router Go
  May 6, 2026
• Medium 4.1
  GHSA-fcmh-qfxc-w685

  kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level

  ## Summary When kube-router is configured with per-node BGP peer passwords using the `kube-router.io/peer.passwords` node annotation, and verbose logging is enabled (`--v=2` or higher), the raw Kubernetes node annotation map is logged verbatim — including the…

  github.com/cloudnativelabs/kube-router github.com/cloudnativelabs/kube-router/v2 Go
  Apr 8, 2026
• High 7.1
  CVE-2026-32254

  Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS

  Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for…

  cloudnativelabs kube-router github.com/cloudnativelabs/kube-router github.com/cloudnativelabs/kube-router/v2 Go
  Mar 18, 2026