https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 08:04:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276432 EUVD-2026-276432 https://cve.radiocsirt.org/vuln/euvd-2026-276432 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32254 <p>Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router&#39;s proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node&#39;s network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.</p> <p>Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router&#39;s proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node&#39;s network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds include enabling DenyServiceExternalIPs feature gate, deploying admission policy, restricting service creation RBAC, monitoring service changes, and applying BGP prefix filtering.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32254 https://cve.radiocsirt.org/vuln/ghsa-phqm-jgc3-qf8g <p><strong>Affected:</strong> Go: github.com/cloudnativelabs/kube-router/v2</p> <p># kube-router Proxy Module Does Not Validate ExternalIPs or LoadBalancer IPs Against Configured Ranges</p> <p>## Summary</p> <p>This issue primarily affects multi-tenant clusters where untrusted users are granted namespace-scoped permissions to create or modify Services. Single-tenant clusters or clusters where all Service creators are trusted are not meaningfully affected.</p> <p>The kube-router proxy module&#39;s `buildServicesInfo()` function directly copies IPs from `Service.spec.externalIPs` and `status.loadBalancer.ingress` into node-level network configuration (kube-dummy-if interface, IPVS virtual services, LOCAL routing table) without validating them against the `--service-external-ip-range` parameter. A user with namespace-scoped Service CRUD permissions can bind arbitrary VIPs on all cluster nodes or cause denial of service to critical cluster services such as kube-dns.</p> <p>The `--service-external-ip-range` parameter is only consumed by the netpol (network policy) module for firewall RETURN rules. The proxy module never reads this configuration, creating a gap between administrator expectations and actual enforcement.</p> <p>Kubernetes&#39; `DenyServiceExternalIPs` Feature Gate was introduced in v1.22 and remains disabled by default through v1.31, meaning most clusters allow Services to carry externalIPs without any admission control.</p> <p>**Note:** This vulnerability class is not unique to kube-router. The upstream Kubernetes project classified the equivalent issue as [CVE-2020-8554](https://github.co…</p> <p><strong>Affected:</strong> Go: github.com/cloudnativelabs/kube-router/v2</p> <p># kube-router Proxy Module Does Not Validate ExternalIPs or LoadBalancer IPs Against Configured Ranges</p> <p>## Summary</p> <p>This issue primarily affects multi-tenant clusters where untrusted users are granted namespace-scoped permissions to create or modify Services. Single-tenant clusters or clusters where all Service creators are trusted are not meaningfully affected.</p> <p>The kube-router proxy module&#39;s `buildServicesInfo()` function directly copies IPs from `Service.spec.externalIPs` and `status.loadBalancer.ingress` into node-level network configuration (kube-dummy-if interface, IPVS virtual services, LOCAL routing table) without validating them against the `--service-external-ip-range` parameter. A user with namespace-scoped Service CRUD permissions can bind arbitrary VIPs on all cluster nodes or cause denial of service to critical cluster services such as kube-dns.</p> <p>The `--service-external-ip-range` parameter is only consumed by the netpol (network policy) module for firewall RETURN rules. The proxy module never reads this configuration, creating a gap between administrator expectations and actual enforcement.</p> <p>Kubernetes&#39; `DenyServiceExternalIPs` Feature Gate was introduced in v1.22 and remains disabled by default through v1.31, meaning most clusters allow Services to carry externalIPs without any admission control.</p> <p>**Note:** This vulnerability class is not unique to kube-router. The upstream Kubernetes project classified the equivalent issue as [CVE-2020-8554](https://github.co…</p> https://cve.radiocsirt.org/vuln/ghsa-phqm-jgc3-qf8g