# Arbitrary host-network port routing

Do weaker-validated route or slice objects let a tenant point traffic at arbitrary host-network ports?

_Area: Cloud and container security. Seen in 5 disclosed reports; latest 2026-09-18. Updated 2026-11-01._

## How it works
A routing layer trusts an object that a less-privileged user can write. The object names a destination address or port, and the dataplane (kube-proxy, a load balancer, a container network profile) programs it without checking that the destination belongs to the writer. The broken assumption is "whoever can write a route object may only route to their own backends." When that fails, the writer redirects traffic meant for someone else — a victim IP, a host-network port, another tenant's pod — to a place they control or can reach [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md)[E3](https://bugbountylibrary.com/r/h1%3A764986.md)[E4](https://bugbountylibrary.com/r/h1%3A1145044.md)[E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md).

## Where it shows up
- Service fields `externalIPs` and `status.loadBalancer.ingress` accepted without ownership checks [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md)[E3](https://bugbountylibrary.com/r/h1%3A764986.md)
- A newer API reimplementing an older one with looser validation (EndpointSlice vs Endpoints) [E4](https://bugbountylibrary.com/r/h1%3A1145044.md)
- Namespace-scoped Endpoint/EndpointSlice objects consumed by a shared ingress or LoadBalancer controller [E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md)
- Container network profiles allowing `host.docker.internal` or the Docker gateway by default [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md)
- Unauthenticated control-plane or proxy endpoints bound to localhost/host network [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md)

## How to review
Identify every object a low-privilege principal can create or patch, then trace where its address/port fields are programmed into host routing. The invariant: a route object may only direct traffic to destinations the writer owns, and never to node IPs, pod IPs, ClusterIPs, localhost, or host-network ports outside its namespace. Check that validation rejects overlaps with existing ranges [E3](https://bugbountylibrary.com/r/h1%3A764986.md), that new APIs enforce the same port restrictions as the old ones [E4](https://bugbountylibrary.com/r/h1%3A1145044.md), and that shared controllers do not trust tenant-writable slices across namespaces [E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md). For container runtimes, confirm the default profile blocks host gateway access and that any reachable control plane requires authentication [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md).

## How finders spotted it
- Set `externalIPs` to node IPs while debugging MetalLB; kube-proxy added them to `kube-ipvs0` and broke inter-node traffic, revealing arbitrary IPs can be claimed [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md)
- Hypothesized kube-proxy skips range validation, then tested service types against external, ClusterIP, pod and localhost targets across IPVS/iptables modes [E3](https://bugbountylibrary.com/r/h1%3A764986.md)
- Diffed Endpoints validation against the newer EndpointSlice validation code and found the port restrictions dropped [E4](https://bugbountylibrary.com/r/h1%3A1145044.md)
- Reasoned from how Services decouple identity from pod IPs in multi-tenant clusters, concluding endpoint writers control routing [E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md)
- Probed `host.docker.internal` ports from inside a default-configured container to find the control plane [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md)

## Variants seen
- Claiming arbitrary external/LoadBalancer IPs to MITM cluster traffic [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md)[E3](https://bugbountylibrary.com/r/h1%3A764986.md)
- Pointing a slice at 127.0.0.1 with arbitrary ports to hit host-network admin services [E4](https://bugbountylibrary.com/r/h1%3A1145044.md)
- Cross-namespace redirection of shared ingress traffic, bypassing network policies [E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md)
- Container reaching host services via the Docker gateway under a permissive default profile [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md)

## Impact and severity
MITM of DNS and internal traffic enables credential and token theft, escalating to cluster compromise [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md). Host-network port targeting reaches admin services like Fluent Bit [E4](https://bugbountylibrary.com/r/h1%3A1145044.md). Cross-tenant redirection bypasses network policies [E5](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md). Container-to-host pivots reach privileged tools and the control plane without a container escape [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md). Impact rises with the sensitivity of intercepted traffic and the breadth of the shared controller's reach.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-qg2g-g9w3-m5h8.md
- E3: https://bugbountylibrary.com/r/h1%3A764986.md
- E4: https://bugbountylibrary.com/r/h1%3A1145044.md
- E5: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740.md