VDB
CVE-2026-32254
CVE-2026-32254
PUBLISHED
CVSS 7.099999904632568 HIGH
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS
EPSS 0.06% · 20.0th percentile
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS Score
0.06%
20.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| kube-router | kube-router | 0, 0, 0 |
| cloudnativelabs | kube-router | < 2.8.0, *, < 2.8.0 |
| github.com | cloudnativelabs/kube-router/v2 | 0, 0, 0 |
Timeline
- Mar 17, 2026 CVE Published
- Mar 17, 2026 PoC Published
- Mar 18, 2026 EPSS Score
- Mar 18, 2026 PoC Published
- Mar 18, 2026 Security Advisory
- Mar 19, 2026 EPSS Score
- Mar 20, 2026 EPSS Score
- Mar 20, 2026 PoC Published
- Mar 21, 2026 EPSS Score
- Mar 22, 2026 EPSS Score
- Mar 22, 2026 Coalition ESS Score
- Mar 23, 2026 EPSS Score
References
- https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-phqm-jgc3-qf8g url
- https://github.com/cloudnativelabs/kube-router/commit/a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456 url
- https://github.com/cloudnativelabs/kube-router/releases/tag/v2.8.0 url
- https://nvd.nist.gov/vuln/detail/CVE-2026-32254 advisory
- https://github.com/cloudnativelabs/kube-router package