AIKIDO-2025-10995

TL;DR

Affected versions of this package are vulnerable to a Service Port Security Bypass, where the --onlyAllowTrafficServicePorts flag and enable_service_security setting fail to apply intended port restriction rules, allowing an attacker who can route traffic to a load balancer IP (e.g., via BGP with kube-vip) to access sensitive Kubernetes API ports (like 6443 and 10250) that should be blocked, thereby exposing the cluster's control plane and node endpoints.