{"answers":{"affected":"4 open source packages ship an affected version, including github.com/cloudnativelabs/kube-router/v2 and github.com/cloudnativelabs/kube-router.","exploited":"There is no known exploitation of GHSA-fcmh-qfxc-w685 in the wild and no public exploit code.","fix":"No fix has been published for GHSA-fcmh-qfxc-w685 yet. Limit exposure of the affected software until one is available.","what":"GHSA-fcmh-qfxc-w685 is a vulnerability in github.com/cloudnativelabs/kube-router, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-fcmh-qfxc-w685 and fix it if it is affected.\n\nWhat it is: GHSA-fcmh-qfxc-w685 is a vulnerability in github.com/cloudnativelabs/kube-router, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-fcmh-qfxc-w685 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/cloudnativelabs/kube-router/v2 (Go): affected from 2.7.0; no fix listed\n- github.com/cloudnativelabs/kube-router/v2 (Go): affected from 2.7.0 up to 2.8.0; no fix listed\n- github.com/cloudnativelabs/kube-router/v2 (Go): affected from 2.7.0 up to 2.8.0; no fix listed\n- github.com/cloudnativelabs/kube-router (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-fcmh-qfxc-w685/ (Markdown: https://insights.sbomify.com/GHSA-fcmh-qfxc-w685/index.md)","id":"GHSA-fcmh-qfxc-w685","markdown":"https://insights.sbomify.com/GHSA-fcmh-qfxc-w685/index.md","name":"GHSA-fcmh-qfxc-w685","record":{"aliases":["GO-2026-5354"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"patch","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Kubernetes networking plugin","requires_auth":"low_privilege","summary":"Attackers with log access can extract BGP peer passwords from kube-router logs when verbose logging is enabled, compromising network security.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nWhen kube-router is configured with per-node BGP peer passwords using the `kube-router.io/peer.passwords` node annotation, and verbose logging is enabled (`--v=2` or higher), the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 passwords. Anyone with access to kube-router's logs (via `kubectl logs`, log aggregation systems, or shared log dumps during debugging) can extract and decode the BGP peer passwords. The official troubleshooting documentation instructs users to collect logs at `-v=2` before filing issues, making accidental disclosure during support interactions a realistic scenario.\n\n## Details\n\nThe vulnerability is at `pkg/controllers/routing/network_routes_controller.go:1129`:\n\n```go\n// pkg/controllers/routing/network_routes_controller.go:1127-1133\n// If the global routing peer is configured then peer with it\n// else attempt to get peers from node specific BGP annotations.\nif len(nrc.globalPeerRouters) == 0 {\n    klog.V(2).Infof(\"Attempting to construct peer configs from annotation: %+v\", node.Annotations)\n    peerCfgs, err := bgpPeerConfigsFromAnnotations(\n```\n\n`node.Annotations` is of type `map[string]string`. This type does not implement `fmt.Stringer`, so `%+v` formatting dumps every key-value pair verbatim. When `kube-router.io/peer.passwords` is set on the node (the documented mechanism for providing per-node BGP MD5 passwords), its base64-encoded value appears in the log output.\n\nThe BGP peer password annotation is documented in `docs/user-guide.md` and has the constant:\n\n```go\n// pkg/controllers/routing/network_routes_controller.go:59\npeerPasswordAnnotation = \"kube-router.io/peer.passwords\"\n```\n\nNote that a password-safe `String()` method exists on `PeerConfig` and `PeerConfigs` in `pkg/bgp/peer_config.go` and is tested:\n\n```go\n// pkg/bgp/peer_config.go:63-79\n// Custom Stringer to prevent leaking passwords when printed\nfunc (p PeerConfig) String() string {\n    // ...password field is intentionally omitted...\n}\n```\n\nHowever, this protective method is never invoked by the vulnerable log statement, which dumps the raw annotation map before any parsing occurs. The password masking only applies after the annotation is parsed into `PeerConfig` structs.\n\nThe second log statement at line 1510 (`klog.Infof(\"Peer config from %s annotation: %+v\", peersAnnotation, peerConfigs)`) is **not vulnerable** — `peerConfigs` is of type `bgp.PeerConfigs` which implements `fmt.Stringer` and correctly masks passwords.\n\nThe vulnerable path (`bgpPeerConfigsFromIndividualAnnotations`) is triggered when the `kube-router.io/peers` consolidated YAML annotation is not set — i.e., when operators use the older individual annotation format (`kube-router.io/peer.ips`, `kube-router.io/peer.asns`, `kube-router.io/peer.passwords`). This older format remains fully supported and documented.\n\n## PoC\n\n**Setup**: Node has per-node BGP peer annotations including a password:\n```bash\nkubectl annotate node worker-1 \\\n  kube-router.io/peer.ips=192.0.2.1 \\\n  kube-router.io/peer.asns=65001 \\\n  \"kube-router.io/peer.passwords=$(echo -n 's3cr3t-bgp-p@ss' | base64)\"\n```\n\n**Trigger**: Start kube-router with verbose logging (e.g., following troubleshooting documentation):\n```bash\n# As documented in docs/troubleshoot.md for debugging:\nkube-router ... --v=2\n```\n\n**Observe**: In kube-router pod logs:\n```\nI0318 10:23:41.123456 1 network_routes_controller.go:1129] Attempting to construct peer configs from annotation:\nmap[\n  kube-router.io/peer.asns:65001\n  kube-router.io/peer.ips:192.0.2.1\n  kube-router.io/peer.passwords:czNjcjN0LWJncC1wQHNz   \u003c-- base64-encoded password\n  ...other annotations...\n]\n```\n\n**Decode the password**:\n```bash\necho \"czNjcjN0LWJncC1wQHNz\" | base64 -d\n# Output: s3cr3t-bgp-p@ss\n```\n\n**Impact**: With the decoded password and network adjacency to the BGP peer, an attacker can establish an unauthorized BGP session, inject routes, or disrupt legitimate BGP peering.\n\n## Impact\n\n- **BGP credential disclosure**: BGP MD5 authentication passwords are exposed to anyone with access to kube-router log output\n- **BGP session hijacking**: An attacker who obtains the password and has network-level access to a BGP neighbor can impersonate the kube-router node, injecting malicious routes into the BGP table\n- **Log forwarding risk**: Log aggregation systems (Fluentd, Loki, Elastic, Splunk) typically have different and often broader access controls than Kubernetes RBAC. Passwords aggregated into these systems may be accessible to personnel without Kubernetes node access\n- **Support workflow exposure**: The official troubleshooting documentation recommends collecting `--v=2` logs before filing issues, creating a realistic path for passwords to be shared in bug reports or support tickets\n\n## Recommended Fix\n\nRemove or redact the vulnerable log statement at line 1129. The diagnostic information it provides (confirming that annotation-based peer configuration is being used) can be conveyed without exposing credential values:\n\n```go\n// Before (vulnerable):\nklog.V(2).Infof(\"Attempting to construct peer configs from annotation: %+v\", node.Annotations)\n\n// After (safe):\nklog.V(2).Infof(\"Attempting to construct peer configs from per-node annotations (kube-router.io/peer.ips, etc.)\")\n```\n\nIf full annotation content is needed for debugging (e.g., to show non-sensitive annotations), log a filtered version that explicitly excludes the password annotation:\n\n```go\n// Safe alternative that preserves non-sensitive diagnostic info:\nsafeAnnotations := make(map[string]string)\nfor k, v := range node.Annotations {\n    if k != peerPasswordAnnotation {\n        safeAnnotations[k] = v\n    }\n}\nklog.V(2).Infof(\"Attempting to construct peer configs from annotations: %+v\", safeAnnotations)\n```","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level","id":"GHSA-fcmh-qfxc-w685","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/cloudnativelabs/kube-router","purl":"pkg:golang/github.com/cloudnativelabs/kube-router","source":"GO-2026-5354"},{"ecosystem":"Go","fixed":[],"introduced":["2.7.0"],"last_affected":[],"package":"github.com/cloudnativelabs/kube-router/v2","purl":"pkg:golang/github.com/cloudnativelabs/kube-router/v2","source":"GO-2026-5354"},{"ecosystem":"Go","fixed":[],"introduced":["2.7.0"],"last_affected":["2.8.0"],"package":"github.com/cloudnativelabs/kube-router/v2","purl":null,"source":"GHSA-fcmh-qfxc-w685"},{"ecosystem":"Go","fixed":[],"introduced":["2.7.0"],"last_affected":["2.8.0"],"package":"github.com/cloudnativelabs/kube-router/v2","purl":"pkg:golang/github.com/cloudnativelabs/kube-router/v2","source":"GHSA-fcmh-qfxc-w685"}],"products":null,"published":"2026-04-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with log access can extract BGP peer passwords from kube-router logs when verbose logging is enabled, compromising network security.","url":"https://insights.sbomify.com/GHSA-fcmh-qfxc-w685/"}