CVE-2026-32254 | THREATINT

Description

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-18 | Updated 2026-03-18 | Assigner GitHub_M

HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Problem types

CWE-284: Improper Access Control

Product status

< 2.8.0

affected

References

github.com/...router/security/advisories/GHSA-phqm-jgc3-qf8g exploit

github.com/...router/security/advisories/GHSA-phqm-jgc3-qf8g

github.com/...ommit/a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456

github.com/cloudnativelabs/kube-router/releases/tag/v2.8.0

cve.org (CVE-2026-32254)

nvd.nist.gov (CVE-2026-32254)

Download JSON