CVE-2026-32254: GO-2026-4724 - Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloud

CVE-2026-32254 · Severity: low · CVSS 3.1 · Published 2026-03-26

Technologies: github.com/cloudnativelabs/kube-router/v2 (Go), github.com/cloudnativelabs/kube-router (Go). Vendors: Go.

Executive brief

Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloudnativelabs/kube-router

Affected products

Go github.com/cloudnativelabs/kube-router/v2
Go github.com/cloudnativelabs/kube-router

Related threats

GO-2026-5653 - kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.co
GO-2026-5354 - kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router
kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level