CVE-2025-54246: routersv Unauthenticated Endpoints Expose Cluster Route & Cache Topology

Vulnerability Summary: Missing Authentication on All routersv API Endpoints Overview Vulnerability Name: routersv-no-auth: Missing authentication on all routersv API endpoints CVE ID: CVE-2025-54246 Severity: 5.7 / 10 (Medium) Affected Versions: < v0.27.13 Fixed Version: v0.27.13 Description: The routersv component exposes the full cluster routing topology (Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths) and cached cluster topology (Redis/Valkey shard addresses) with no authentication. Any Pod within a Kubernetes cluster can access routersv via predictable DNS names, allowing it to read cluster-level routing and cache infrastructure data. Impact Scope Exposed Data: - : All Ingress/RouteGroup configurations (including backends, internal service URLs, filter chains, authentication, rate limiting, OAuth, OPA policies, and load balancer member relationships) - : The above routing data partitioned by zone - : Internal IP:port pairs for the Redis cluster - : Internal IP:port pairs for the Valkey cluster Attack Path: After an attacker gains access to any Pod in the cluster via a supply chain attack or a malicious container image, they can access the above endpoints through predictable DNS names such as , extracting data without any authentication. Permission Boundary: routersv uses a ServiceAccount combined with cluster-level RBAC (cluster:client, go:648-653 fetchClusterState). Kube upstream services require a ServiceAccount token + RBAC authorization. Pods with restricted RBAC can read from routersv to bypass these restrictions and obtain cluster-level data. Network Policy Note: NetworkPolicy cannot compensate for the missing authentication mechanism; as long as the network is reachable, routersv will expose control plane data to unauthenticated callers. Remediation 1. Add authentication to all routersv HTTP endpoints (Basic Auth, Bearer token, mTLS, or shared secret), configured via . 2. Deploy a Kubernetes NetworkPolicy restricting access to routersv, allowing only specific Pod selectors. 3. Consider using mutual TLS authentication between data plane and control plane components. POC / Exploit Code routersv/routersv.go:87-99,114-137 — Handler registration on the main mux (zero authentication) routersv/exskiptls.go:134-196 — exskiptls.ServerHTTP routersv/redisshander.go:28-41 — RedisHandler.ServerHTTP routersv/valkeyhandler.go:28-41 — ValkeyHandler.ServerHTTP exskiptls/reoute.go:129-219 — Data plane client

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-54246: routersv Unauthenticated Endpoints Expose Cluster Route & Cache Topology

More from this source