Kube‑router’s proxy module, prior to version 2.8.0, fails to validate the externalIPs or LoadBalancer IPs that are assigned to a service before programming them into a node’s network configuration. This flaw permits a cluster administrator or any user with sufficient RBAC permissions to introduce arbitrary IP addresses into the cluster, effectively hijacking traffic that matches those IPs across the entire Kubernetes environment. The vulnerability is identified as CWE‑284 (Improper Authorization).

All releases of cloudnativelabs:kube‑router older than v2.8.0 are affected. Any deployment that uses the proxy module and allows services to specify externalIPs or LoadBalancer IPs is vulnerable, regardless of the underlying Kubernetes version. The issue is fixed in kube‑router v2.8.0 and later releases.

The CVSS score of 7.1 indicates a high-impact vulnerability. The EPSS score is reported to be less than 1 %, implying that exploitation is currently uncommon in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to create or modify services with arbitrary externalIPs or LoadBalancer IPs, typically a privilege reserved for cluster administrators or highly privileged users. Once a malicious IP is injected, an attacker can redirect or hijack traffic destined for any pod exposed through the affected service. There is no evidence from the CVE description of a denial‑of‑service capability beyond traffic hijacking.