GO-2026-5653 - kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.co

Severity: info · Published 2026-06-25

Technologies: github.com/cloudnativelabs/kube-router/v2 (Go), github.com/cloudnativelabs/kube-router (Go). Vendors: Go.

Executive brief

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router

Affected products

Go github.com/cloudnativelabs/kube-router/v2
Go github.com/cloudnativelabs/kube-router

Related threats

GO-2026-5354 - kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router
kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level
GO-2026-4724 - Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloud