CVE-2026-32254 Details
Description
Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.
A vulnerability exists in Kube-router's proxy module, prior to version 2.8.0, where externalIPs and loadBalancer IPs are not validated against configured ranges before being applied to the node's network settings. This flaw can be exploited by users with namespace-scoped permissions to create or modify Services, leading to unauthorized traffic redirection and potential disruption of critical services like DNS. The issue arises because the proxy module ignores the 'service-external-ip-range' parameter, creating a disconnect between administrative controls and actual enforcement.
Users are advised to upgrade to Kube-router version 2.8.0 or later, where this vulnerability has been addressed. For those unable to upgrade immediately, the DenyServiceExternalIPs feature gate can be enabled, and admission policies can be deployed to restrict the use of externalIPs in Services. Additionally, monitoring Service changes and applying BGP prefix filtering can help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-phqm-jgc3-qf8g | CISA-ADP | ExploitMitigationPatchVendor Advisory |
| https://github.com/cloudnativelabs/kube-router/commit/a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456 | [email protected] | Patch |
| https://github.com/cloudnativelabs/kube-router/releases/tag/v2.8.0 | [email protected] | ProductRelease Notes |
| https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-phqm-jgc3-qf8g | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kube-router kube-router | < 2.8.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | New CVE Received | [email protected] |