CVE-2026-32254 Overview
CVE-2026-32254 affects Kube-router, a turnkey solution for Kubernetes networking that provides service proxy, network policy, and BGP routing. The proxy module fails to validate externalIPs and loadBalancer IPs before programming them into the node's network configuration. An authenticated user with permissions to create or modify Kubernetes Services can supply arbitrary IP addresses. Kube-router then installs these addresses on cluster nodes without verification. Versions prior to 2.8.0 are affected, and the issue is categorized under CWE-284: Improper Access Control.
Critical Impact
Authenticated users can hijack arbitrary IP addresses on Kubernetes nodes, redirect traffic, and disrupt cluster network availability.
Affected Products
- Kube-router versions prior to 2.8.0
- Kubernetes clusters using Kube-router as service proxy
- Deployments with BGP advertisement enabled for external IPs
Discovery Timeline
- 2026-03-18 - CVE-2026-32254 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-32254
Vulnerability Analysis
Kube-router's proxy module programs service IP addresses directly into node networking state, including IPVS, iptables, and BGP advertisements. The proxy accepts spec.externalIPs and status.loadBalancer.ingress values from Kubernetes Service objects without validating that the requesting user has authority over those addresses. The vulnerability falls under improper access control [CWE-284] and is exploitable over the network by an attacker holding low-privilege Kubernetes API access.
The issue affects integrity and availability of the cluster network. An attacker can claim IP addresses belonging to legitimate services, internal infrastructure, or upstream networks. Because Kube-router can also advertise these IPs via BGP, the impact can extend beyond the cluster boundary into the broader routing domain.
Root Cause
The proxy module trusts Service object fields as authoritative without policy enforcement. Kubernetes itself does not restrict externalIPs by default unless the DenyServiceExternalIPs feature gate or an admission controller is configured. Kube-router compounds the gap by programming any supplied address into node networking and, when BGP is enabled, propagating it to peers.
Attack Vector
An attacker with namespace-level Service creation rights submits a Service manifest containing an externalIPs entry pointing to a sensitive address, such as the API server, a node IP, or a third-party service. Kube-router installs the IP on cluster nodes, intercepting traffic destined for the legitimate owner. Where BGP advertisement is enabled, the malicious prefix propagates to peer routers, broadening the blast radius. Full exploitation details are documented in the GitHub Security Advisory GHSA-phqm-jgc3-qf8g.
Detection Methods for CVE-2026-32254
Indicators of Compromise
- Service objects containing externalIPs values that match node IPs, control plane IPs, or addresses outside the cluster's service CIDR
- Unexpected IPVS or iptables entries on Kube-router nodes referencing IPs not allocated by the cluster
- BGP advertisements from Kube-router peers containing prefixes that do not belong to the cluster
Detection Strategies
- Audit the Kubernetes API server logs for create and update actions on services resources where spec.externalIPs is set
- Compare Service externalIPs and loadBalancer.ingress values against an approved IP allowlist for the environment
- Inspect Kube-router BGP session state and advertised prefixes against expected service ranges
Monitoring Recommendations
- Stream Kubernetes audit logs to a centralized analytics platform and alert on any Service mutation that introduces externalIPs
- Continuously diff node ip addr and IPVS state against the set of validated Service IPs
- Monitor upstream BGP peers for route updates originating from Kube-router speakers and flag unexpected prefixes
How to Mitigate CVE-2026-32254
Immediate Actions Required
- Upgrade Kube-router to version 2.8.0 or later on all clusters, as referenced in the v2.8.0 release notes
- Enable the Kubernetes DenyServiceExternalIPs feature gate on the API server to block unrestricted use of externalIPs
- Review existing Services across all namespaces and remove any unauthorized externalIPs entries
- Tighten RBAC so that only trusted service accounts can create or modify Service objects
Patch Information
The fix is delivered in Kube-router 2.8.0 through commit a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456. The patch adds validation of externalIPs and loadBalancer IPs before they are programmed into node network configuration. Operators should refer to the GitHub Security Advisory GHSA-phqm-jgc3-qf8g for the full remediation guidance.
Workarounds
- Enable the DenyServiceExternalIPs admission feature gate on the Kubernetes API server
- Deploy an admission policy using OPA Gatekeeper or Kyverno to reject Services that set externalIPs outside an approved list
- Restrict RBAC permissions for services resources to a minimal set of trusted principals
- Apply BGP prefix filtering on upstream routers to reject advertisements outside the cluster's authorized ranges
# Configuration example: enable DenyServiceExternalIPs on kube-apiserver
# Add to the API server manifest or systemd unit
--feature-gates=DenyServiceExternalIPs=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.