Junglewise Threat Intelligence

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

Severity: low · CVSS 3.1 · Published 2026-05-06

Technologies: github.com/cloudnativelabs/kube-router (Go). Vendors: Go.

Executive brief

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

Affected products

Go github.com/cloudnativelabs/kube-router

Related threats

GO-2026-5653 - kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.co
GO-2026-5354 - kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router
GO-2026-4724 - Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloud