kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level
Date: 2026-04
Affected: go/github.com/cloudnativelabs/kube-router/v2
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-532
CVSS: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)

## Summary When kube-router is configured with per-node BGP peer passwords using the `kube-router.io/peer.passwords` node annotation, and verbose logging is enabled (`--v=2` or higher), the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 passwords. Anyone with access to kube-router's logs (via `kubectl logs`, log aggregation systems, or shared log dumps during debugging) can extract and decode the BGP peer passwords. The official troubleshooting documentation instructs users to collect logs at `-v=2` before filing issues, making accidental disclosure during support interactions a realistic scenario. ## Details The vulnerability is at `pkg/controllers/routing/network_routes_controller.go:1129`: ```go // pkg/controllers/routing/network_routes_controller.go:1127-1133 // If the global routing peer is configured then peer with it // else attempt to get peers from node specific BGP annotations. if len(nrc.globalPeerRouters) == 0 { klog.V(2).Infof("Attempting to construct peer configs from annotation: %+v", node.Annotations) peerCfgs, err := bgpPeerConfigsFromAnnotations( ``` `node.Annotations` is of type `map[string]string`. This type does not implement `fmt.Stringer`, so `%+v` formatting dumps every key-value pair verbatim. When `kube-router.io/peer.passwords` is set on the node (the documented mechanism for providing per-node BGP MD5 passwords), its base64-encoded value appears in the log output. The BGP peer password ann


Mitigations:

Architectural layers (MAESTRO):