PT-2026-25978 · Unknown · Kube-Router
B0B0Haha
+1
·
Published
2026-03-17
·
Updated
2026-03-27
·
CVE-2026-32254
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Kube-router versions prior to 2.8.0
Description
Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. This impacts multi-tenant clusters where untrusted users have namespace-scoped permissions to create or modify Services. The
buildServicesInfo() function copies IPs from Service.spec.externalIPs and status.loadBalancer.ingress without validating them against the --service-external-ip-range parameter. An attacker can bind arbitrary VIPs on all cluster nodes or cause denial of service to critical cluster services such as kube-dns. The --service-external-ip-range parameter is only used by the netpol module and is not checked by the proxy module. This allows attackers to potentially hijack traffic or disrupt DNS services. The vulnerability can be exploited by creating a Service with an externalIP matching the kube-dns ClusterIP, redirecting all DNS queries to attacker-controlled pods. The issue is not unique to kube-router, as the upstream Kubernetes project identified a similar issue as CVE-2020-8554.Recommendations
Update to Kube-router version 2.8.0 or later.
Exploit
Fix
DoS
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kube-Router