CVE-2026-32254: Kube-router Auth Bypass Vulnerability

CVE-2026-32254 Overview

CVE-2026-32254 is an Improper Access Control vulnerability in Kube-router, a turnkey solution for Kubernetes networking. The vulnerability exists in Kube-router's proxy module, which fails to validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. This lack of validation allows attackers with service creation privileges to inject arbitrary IP addresses into the cluster's network stack, potentially leading to traffic interception, denial of service, or network policy bypass.

Critical Impact

Attackers with limited Kubernetes RBAC privileges can manipulate network routing by injecting malicious external IPs, potentially hijacking traffic destined for external services or causing network disruption across the cluster.

Affected Products

• Kube-router versions prior to v2.8.0
• Kubernetes clusters using Kube-router for networking and service proxying
• Environments with unrestricted service creation RBAC permissions

Discovery Timeline

• 2026-03-18 - CVE-2026-32254 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32254

Vulnerability Analysis

The vulnerability is classified under CWE-284 (Improper Access Control), indicating a fundamental flaw in how Kube-router handles trust boundaries for service IP configurations. When a Kubernetes Service object is created or modified with externalIPs or loadBalancerIP fields, Kube-router's proxy module accepts these values without verification against any configured allowlist or network policy constraints.

This architectural oversight means that any user with permissions to create or modify Service objects can specify arbitrary IP addresses that Kube-router will then program into iptables rules and routing configurations on cluster nodes. The network attack vector combined with low-privilege requirements makes this vulnerability particularly concerning in multi-tenant Kubernetes environments.

Root Cause

The root cause lies in the absence of IP validation logic in Kube-router's service processing pipeline. Prior to version 2.8.0, the proxy module directly consumed externalIPs and loadBalancerIP values from Service specifications without comparing them against configured CIDR ranges or invoking any admission control checks. The fix introduces a new svcip package that enforces validation of these IPs against administrator-configured ranges before they are programmed into node network configurations.

Attack Vector

An attacker with Kubernetes RBAC permissions to create or modify Service objects can exploit this vulnerability through the following attack pattern:

1. Create a Kubernetes Service with arbitrary externalIPs or loadBalancerIP values
2. Kube-router programs these IPs into the node's iptables and routing tables
3. Traffic destined for these hijacked IPs gets redirected to attacker-controlled endpoints
4. The attacker can intercept sensitive data, conduct man-in-the-middle attacks, or cause denial of service

The security patch introduces validation by importing and utilizing a new svcip package:

 	"github.com/cloudnativelabs/kube-router/v2/pkg/k8s/indexers"
 	"github.com/cloudnativelabs/kube-router/v2/pkg/metrics"
 	"github.com/cloudnativelabs/kube-router/v2/pkg/options"
+	"github.com/cloudnativelabs/kube-router/v2/pkg/svcip"
 	"github.com/cloudnativelabs/kube-router/v2/pkg/utils"
 	"github.com/cloudnativelabs/kube-router/v2/pkg/version"
 	"k8s.io/klog/v2"

Source: GitHub Commit

The load balancer allocation controller also receives the validation enhancement:

 
 	"github.com/cloudnativelabs/kube-router/v2/pkg/healthcheck"
 	"github.com/cloudnativelabs/kube-router/v2/pkg/options"
+	"github.com/cloudnativelabs/kube-router/v2/pkg/svcip"
+	"github.com/cloudnativelabs/kube-router/v2/pkg/utils"
 	v1core "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"

Source: GitHub Commit

Detection Methods for CVE-2026-32254

Indicators of Compromise

• Kubernetes Service objects with unexpected externalIPs or loadBalancerIP values outside normal ranges
• Anomalous iptables rules on cluster nodes referencing unauthorized external IP addresses
• Unexpected network traffic patterns showing traffic being redirected to unknown endpoints
• Audit log entries showing Service creation/modification by unexpected users or service accounts

Detection Strategies

• Enable Kubernetes audit logging and monitor for Service create/update events with externalIPs or loadBalancerIP fields
• Deploy admission controllers (such as OPA Gatekeeper or Kyverno) to alert on Services with external IPs outside approved ranges
• Implement network monitoring to detect traffic hijacking patterns or unexpected routing behavior
• Use SentinelOne Singularity Cloud Workload Security to monitor container and node-level network configuration changes

Monitoring Recommendations

• Configure alerts for any Service modifications containing externalIPs or loadBalancerIP specifications
• Monitor iptables rule changes on cluster nodes for unauthorized NAT or DNAT rules
• Implement continuous compliance scanning to detect Kube-router versions prior to v2.8.0
• Review Kubernetes RBAC policies to identify overly permissive service creation privileges

How to Mitigate CVE-2026-32254

Immediate Actions Required

• Upgrade Kube-router to version v2.8.0 or later immediately
• Audit all existing Kubernetes Services for unexpected externalIPs or loadBalancerIP configurations
• Review and restrict RBAC permissions for Service creation and modification
• Enable the DenyServiceExternalIPs feature gate as a defense-in-depth measure

Patch Information

The vulnerability is patched in Kube-router version v2.8.0. The fix introduces a new svcip validation package that verifies external IPs and load balancer IPs against administrator-configured allowlist ranges before programming them into node network configurations.

Upgrade resources:

• GitHub Release v2.8.0
• Security Patch Commit
• GitHub Security Advisory GHSA-phqm-jgc3-qf8g

Workarounds

• Enable the DenyServiceExternalIPs Kubernetes feature gate to block all external IP specifications on Services
• Deploy admission policies using OPA Gatekeeper or Kyverno to validate and restrict allowed external IP ranges
• Restrict Service creation and modification RBAC permissions to trusted administrators only
• Monitor Service changes using Kubernetes audit logging and automated alerting
• Apply BGP prefix filtering if using Kube-router's BGP functionality to limit advertised routes

# Enable DenyServiceExternalIPs feature gate in kube-apiserver
# Add to kube-apiserver command line arguments:
--feature-gates=DenyServiceExternalIPs=true

# Example Kyverno ClusterPolicy to restrict externalIPs
# Save as restrict-external-ips.yaml and apply with kubectl apply -f
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-external-ips
spec:
  validationFailureAction: Enforce
  rules:
  - name: deny-external-ips
    match:
      resources:
        kinds:
        - Service
    validate:
      message: "External IPs are not allowed on Services"
      pattern:
        spec:
          X(externalIPs): "null"