PT-2026-25978 · Go+1 · Github.Com/Cloudnativelabs/Kube-Router/V2+1

Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-32254

Mitre

CVSS v3.1

7.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-32254

GHSA-PHQM-JGC3-QF8G

Affected Products

Github.Com/Cloudnativelabs/Kube-Router/V2

Kube-Router

References · 6

• https://osv.dev/vulnerability/GHSA-phqm-jgc3-qf8g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32254 · Security Note
• https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-phqm-jgc3-qf8g · Note
• https://github.com/cloudnativelabs/kube-router · Note
• https://github.com/cloudnativelabs/kube-router/releases/tag/v2.8.0 · Note
• https://github.com/cloudnativelabs/kube-router/commit/a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456 · Note