7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32254

CVE-2026-32254: Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32254

CVE-2026-32254:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cloudnativelabs/kube-router/v2	go	< 2.8.0	2.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because kube-router's proxy and routing modules blindly trust Service.spec.externalIPs and Service.status.loadBalancer.ingress IPs from the Kubernetes API. An attacker with namespace-scoped permissions to create or update Services can specify arbitrary IPs, leading to traffic hijacking or denial of service against critical components like kube-dns.

The analysis of the patch commit a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456 identifies three key vulnerable functions where this lack of validation occurs:

proxy.NetworkServicesController.buildServicesInfo: This function is the primary entry point for the service proxy. It reads Service objects and prepares them for IPVS programming. The patch demonstrates that it previously copied IPs without any checks. The fix involves adding calls to a new IP validator. Exploiting this allows an attacker to bind a malicious service to any IP within the cluster, redirecting traffic.
routing.NetworkRoutingController.getExternalIPs: This function in the routing controller retrieves externalIPs to be advertised via BGP. The patch shows it was also missing validation. This could be exploited to advertise malicious routes to the external network.
routing.NetworkRoutingController.getLoadBalancerIPs: Similarly, this function retrieves loadBalancerIPs for BGP advertisement without validation, creating another vector for advertising malicious routes.

The root cause was the failure to enforce the --service-external-ip-range and --loadbalancer-ip-range configurations in the controllers that handle these IPs. The patch addresses this by introducing a centralized IP validator in a new pkg/svcip package and applying it at all points where service IPs are processed, effectively closing the security gap in both the in-cluster proxy and the external routing logic.

Vulnerable functions

proxy.NetworkServicesController.buildServicesInfo

pkg/controllers/proxy/network_services_controller.go

This function constructs the service information map used by the proxy to configure IPVS. The vulnerability lies in the fact that it directly copied `externalIPs` and `loadBalancerIPs` from the Kubernetes Service object without validating them against any configured IP ranges. An attacker could create a Service with a malicious IP (e.g., the kube-dns ClusterIP), and this function would trust it, leading to the IP being programmed on the node and causing traffic hijacking or a denial-of-service. The patch adds calls to `nsc.ipFilter.FilterExternalIPs` and `nsc.ipFilter.FilterLoadBalancerIPs` to validate the IPs before they are stored.

routing.NetworkRoutingController.getExternalIPs

pkg/controllers/routing/ecmp_vip.go

This function in the routing controller retrieves `externalIPs` from a Service to be advertised via BGP. It was vulnerable because it did not validate these IPs against the configured `--service-external-ip-range`. This allowed a low-privileged user to create a Service with an arbitrary `externalIP`, which would then be advertised by kube-router to its BGP peers, potentially hijacking traffic on the wider network. The patch adds a call to `nrc.ipFilter.FilterExternalIPs` to ensure only valid IPs are returned.

routing.NetworkRoutingController.getLoadBalancerIPs

pkg/controllers/routing/ecmp_vip.go

Similar to `getExternalIPs`, this function retrieves `loadBalancerIPs` from a Service's status to be advertised via BGP. It was vulnerable because it trusted the IPs present in `status.loadBalancer.ingress` without validation against the `--loadbalancer-ip-range`. An attacker could exploit this by creating a Service that gets assigned a malicious IP by an external controller, or by patching the service status, and have that IP advertised to the network. The patch adds a call to `nrc.ipFilter.FilterLoadBalancerIPs` to validate the IPs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.