kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection
Date: 2026-05
Affected: go/github.com/cloudnativelabs/kube-router
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-862
CVSS: 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

## Summary When the kube-router routing controller starts (`--run-router`), it binds the GoBGP gRPC management server to the node's primary IP (e.g., `192.168.1.10:50051`) in addition to `127.0.0.1:50051`. The default admin port is `50051` and the server is enabled by default with no TLS and no authentication. Any pod in the cluster can reach node IPs and therefore call the GoBGP gRPC API to inject arbitrary BGP routes, enumerate peer configurations, add unauthorized BGP neighbors, or withdraw legitimate routes. While kube-router's BGP export policy of `ROUTE_ACTION_REJECT` limits the attack surface to the local node's GoBGP RIB, an attacker can still impact local routing decisions. ## Details The gRPC server is started unconditionally when `--run-router` is active. In `pkg/controllers/routing/network_routes_controller.go`, the `startBgpServer(true)` call at line 365 passes `grpcServer=true`, and the binding logic at lines 1057–1061 is: ```go // pkg/controllers/routing/network_routes_controller.go:1057-1061 if grpcServer && nrc.goBGPAdminPort != 0 { nrc.bgpServer = gobgp.NewBgpServer( gobgp.GrpcListenAddress(net.JoinHostPort(nrc.krNode.GetPrimaryNodeIP().String(), strconv.FormatUint(uint64(nrc.goBGPAdminPort), 10)) + "," + fmt.Sprintf("127.0.0.1:%d", nrc.goBGPAdminPort))) } ``` The default admin port is defined in `pkg/options/options.go`: ```go // pkg/options/options.go:16 defaultGoBGPAdminPort uint16 = 50051 ``` No `gobgp.GrpcOptio


Mitigations:

Architectural layers (MAESTRO):