kube-router versions prior to 2.9.0 run a GoBGP gRPC management server bound to the node's primary IP address without authentication or TLS. This allows any pod in the cluster to access the gRPC API on port 50051 and perform unauthorized actions such as injecting arbitrary BGP routes, enumerating BGP peer configurations, adding or deleting BGP neighbors, and modifying routing policies. Although kube-router's default BGP export policy limits route propagation, the vulnerability enables local BGP state manipulation on nodes, which could impact cluster networking. A fix is available in version 2.9.0 that addresses this exposure.