cloudnativelabs vulnerabilities

Products

• github.com/cloudnativelabs/kube-router/v2 3

Latest cloudnativelabs CVEs

Newest publication first

1. GHSA-v5mh-h5hx-7v92 kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

   Published 2026-05-06

   Medium·CVSS 6.3

   Summary When the kube-router routing controller starts (--run-router), it binds the GoBGP gRPC management server to the node's primary IP (e.g., 192.168.1.10:50051) in addition to 127.0.0.1:50051. The default admin port is 50051 and the server is enabled by default with no TLS an...

2. GHSA-fcmh-qfxc-w685 kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level

   Published 2026-04-08

   Medium·CVSS 4.1

   Summary When kube-router is configured with per-node BGP peer passwords using the kube-router.io/peer.passwords node annotation, and verbose logging is enabled (--v=2 or higher), the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 pass...

3. CVE-2026-32254 Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS

   Published 2026-03-18

   High·CVSS 7.1

   Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.