A high-severity improper access control vulnerability in Kube-router allows authenticated attackers to disrupt network configurations via unauthorized IP assignments.

This is an improper access control flaw where the proxy module fails to validate externalIPs or loadBalancer IPs before programming them into the node network configuration, requiring low-privileged authenticated access to exploit.

Successful exploitation of this vulnerability could lead to network disruption and unauthorized routing manipulations within a Kubernetes cluster. With a CVSS score of 7.1, this flaw poses a significant risk to service availability and internal network integrity, potentially facilitating man-in-the-middle attacks or denial of service for critical infrastructure.

Immediate Action: Upgrade Kube-router to version 2.8.0 or later to implement the necessary validation logic.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious Service object creations or modifications involving externalIPs and loadBalancer configurations.

Compensating Controls: Enable the DenyServiceExternalIPs feature gate, implement strict admission policies, or restrict RBAC permissions for service creation to limit the attack surface while planning for the update.

Public Exploit Available: Unknown.

Given the potential for network-level disruption and the existence of a proof-of-concept, administrators should prioritize updating to version 2.8.0. If an immediate patch is not feasible, applying the recommended feature gates and RBAC restrictions is essential to prevent unauthorized network manipulation by authenticated users.