Cloudanix VulnDB

GHSA-fcmh-qfxc-w685

Medium · 4.1

kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level

CVSS

4.1

EPSS

—

Published

Apr 8, 2026

CISA due date

—

The record

When kube-router is configured with per-node BGP peer passwords using the `kube-router.io/peer.passwords` node annotation, and verbose logging is enabled (`--v=2` or higher), the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 passwords. Anyone with access to kube-router's logs (via `kubectl logs`, log aggregation systems, or shared log dumps during debugging) can extract and decode the BGP peer passwords. The official troubleshooting documentation instructs users to collect logs at `-v=2` before filing issues, making accidental disclosure during support interactions a realistic scenario.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities