CVE-2026-32254
High
Description
Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.
SeverityHigh
CVSS7.1
Exploit probability—
ProductKube-router
PublishedMar 18, 2026
First seenMar 18, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- kube-router kube-router2.8.0 or later
- github.com/cloudnativelabs/kube-router/v22.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kube-router kube-router | v < 2.8.0 | 2.8.0 |
| github.com/cloudnativelabs/kube-router/v2Go | v < 2.8.0 | 2.8.0 |
| github.com/cloudnativelabs/kube-routerGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.