Is github.com/cloudnativelabs/kube-router affected by CVE-2026-32254?

Go github.com/cloudnativelabs/kube-router is affected in >=0.

Is CVE-2026-32254 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

medium

CVE-2026-32254

Go · github.com/cloudnativelabs/kube-router • Go · github.com/cloudnativelabs/kube-router/v2

Summary

Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloudnativelabs/kube-router

Severity: medium
EPSS: 0.3% (p21)
Also known as: GHSA-phqm-jgc3-qf8g, GO-2026-4724, GO-2026-4724#github.com/cloudnativelabs/kube-router, GO-2026-4724#github.com/cloudnativelabs/kube-router/v2
Published: 2026-03-26

References

https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-phqm-jgc3-qf8g
https://nvd.nist.gov/vuln/detail/CVE-2026-32254
https://github.com/cloudnativelabs/kube-router/commit/a1f0b2eea3ee0f66b9a5b5c49dcb714619ccd456

Related advisories

GHSA-v5mh-h5hx-7v92 — medium · Go/github.com/cloudnativelabs/kube-router

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.