Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-86043 (GCVE-0-2026-86043)

Vulnerability from nvd – Published: 2026-09-16 18:51 – Updated: 2026-09-16 19:38

Title

Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:38 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/2cfceab…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC
https://github.com/zalando/skipper/tree/v0.27.35	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86043",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:38:03.907390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:38:17.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:52:33.357Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
        },
        {
          "name": "https://github.com/zalando/skipper/tree/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/tree/v0.27.35"
        }
      ],
      "source": {
        "advisory": "GHSA-5gpm-rgj3-9q76",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86043",
    "datePublished": "2026-09-16T18:51:20.486Z",
    "dateReserved": "2026-09-04T19:29:21.058Z",
    "dateUpdated": "2026-09-16T19:38:17.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65838 (GCVE-0-2026-65838)

Vulnerability from nvd – Published: 2026-09-14 20:01 – Updated: 2026-09-15 13:55

Title

Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:26 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/2cfceab…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.35

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:26:56.403629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:55:41.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.35"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:01:27.862Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
        }
      ],
      "source": {
        "advisory": "GHSA-8qqm-fp2q-v734",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65838",
    "datePublished": "2026-09-14T20:01:27.862Z",
    "dateReserved": "2026-07-22T23:16:47.753Z",
    "dateUpdated": "2026-09-15T13:55:41.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54247 (GCVE-0-2026-54247)

Vulnerability from nvd – Published: 2026-09-14 20:04 – Updated: 2026-09-16 16:19

Title

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 16:19 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4053	x_refsource_MISC
https://github.com/zalando/skipper/commit/c3d156c…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.26.22

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:19:01.486253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:19:12.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:04:06.550Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-cwxq-rc9x-2jvv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-cwxq-rc9x-2jvv"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4053",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4053"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/c3d156c6caaefecc9a46774c0f9c3c70b97160b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/c3d156c6caaefecc9a46774c0f9c3c70b97160b4"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.26.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.26.22"
        }
      ],
      "source": {
        "advisory": "GHSA-cwxq-rc9x-2jvv",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54247",
    "datePublished": "2026-09-14T20:04:06.550Z",
    "dateReserved": "2026-06-12T16:25:43.085Z",
    "dateUpdated": "2026-09-16T16:19:12.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54246 (GCVE-0-2026-54246)

Vulnerability from nvd – Published: 2026-09-14 20:03 – Updated: 2026-09-15 14:38

Title

Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 14:38 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4056	x_refsource_MISC
https://github.com/zalando/skipper/commit/fb3d5f9…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:38:31.741550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:38:38.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:03:14.613Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4056",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4056"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/fb3d5f98ee749d9a1dfc5df2d51ac9b82fab92aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/fb3d5f98ee749d9a1dfc5df2d51ac9b82fab92aa"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.13"
        }
      ],
      "source": {
        "advisory": "GHSA-5587-2x54-jj6h",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54246",
    "datePublished": "2026-09-14T20:03:14.613Z",
    "dateReserved": "2026-06-12T16:25:43.085Z",
    "dateUpdated": "2026-09-15T14:38:38.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65604 (GCVE-0-2026-65604)

Vulnerability from nvd – Published: 2026-07-23 21:16 – Updated: 2026-07-24 14:04

Title

Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Summary

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 14:03 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/skipper-inco…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	cpe:2.3:a:zalando:skipper::::::::

Date Public

2026-07-09 00:00

Credits

sec-reex

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65604",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T14:03:58.021319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T14:04:07.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "skipper",
          "vendor": "zalando"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "sec-reex"
        }
      ],
      "datePublic": "2026-07-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T21:16:47.608Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-8qqm-fp2q-v734)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
        },
        {
          "name": "VulnCheck Advisory: Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass"
        }
      ],
      "title": "Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-65604",
    "datePublished": "2026-07-23T21:16:47.608Z",
    "dateReserved": "2026-07-22T10:48:36.000Z",
    "dateUpdated": "2026-07-24T14:04:07.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50197 (GCVE-0-2026-50197)

Vulnerability from nvd – Published: 2026-07-17 19:23 – Updated: 2026-07-20 14:33

Title

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 14:33 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4041	x_refsource_MISC
https://github.com/zalando/skipper/commit/3152f3b…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.26.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50197",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T14:33:19.738683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T14:33:29.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper\u0027s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:23:43.574Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4041",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4041"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.26.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.26.10"
        }
      ],
      "source": {
        "advisory": "GHSA-659f-rgp5-w4wf",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50197",
    "datePublished": "2026-07-17T19:23:43.574Z",
    "dateReserved": "2026-06-03T22:05:13.645Z",
    "dateUpdated": "2026-07-20T14:33:29.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24470 (GCVE-0-2026-24470)

Vulnerability from nvd – Published: 2026-01-26 22:23 – Updated: 2026-01-27 14:51

Title

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-27 14:50 UTC

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/a4c87ce…	x_refsource_MISC
https://kubernetes.io/docs/concepts/services-netw…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T14:50:06.337869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T14:51:35.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper\u0027s network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T22:23:43.325Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219"
        },
        {
          "name": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname"
        }
      ],
      "source": {
        "advisory": "GHSA-mxxc-p822-2hx9",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24470",
    "datePublished": "2026-01-26T22:23:43.325Z",
    "dateReserved": "2026-01-23T00:38:20.546Z",
    "dateUpdated": "2026-01-27T14:51:35.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23742 (GCVE-0-2026-23742)

Vulnerability from nvd – Published: 2026-01-16 20:07 – Updated: 2026-01-16 20:24

Title

Skipper arbitrary code execution through lua filters

Summary

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-16 20:22 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-250 - Execution with Unnecessary Privileges
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/0b52894…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v0.23.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T20:22:53.499072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-16T20:24:12.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T20:07:46.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.23.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.23.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cc8m-98fm-rc9g",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper arbitrary code execution through lua filters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23742",
    "datePublished": "2026-01-16T20:07:46.746Z",
    "dateReserved": "2026-01-15T15:45:01.958Z",
    "dateUpdated": "2026-01-16T20:24:12.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-38580 (GCVE-0-2022-38580)

Vulnerability from nvd – Published: 2022-10-24 00:00 – Updated: 2026-07-09 00:20

Summary

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-07 14:23 UTC

CWE

n/a

Assigner

mitre mitre root

References

3 references

URL	Tags
https://pastebin.com/dXxpgPAK
https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b7…
http://packetstormsecurity.com/files/171546/X-Ski…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:20:56.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pastebin.com/dXxpgPAK"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-38580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T14:23:09.483594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T14:24:29.244Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T15:56:19.950Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://pastebin.com/dXxpgPAK"
        },
        {
          "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
        },
        {
          "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-38580",
    "datePublished": "2022-10-24T00:00:00.000Z",
    "dateReserved": "2022-08-22T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:20:56.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-34296 (GCVE-0-2022-34296)

Vulnerability from nvd – Published: 2022-06-22 12:57 – Updated: 2024-08-03 09:07

Summary

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:07:15.958Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-22T12:57:53.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-34296",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/zalando/skipper/releases/tag/v0.13.218",
              "refsource": "MISC",
              "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-34296",
    "datePublished": "2022-06-22T12:57:53.000Z",
    "dateReserved": "2022-06-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T09:07:15.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-86043 (GCVE-0-2026-86043)

Vulnerability from cvelistv5 – Published: 2026-09-16 18:51 – Updated: 2026-09-16 19:38

Title

Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:38 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/2cfceab…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC
https://github.com/zalando/skipper/tree/v0.27.35	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86043",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:38:03.907390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:38:17.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:52:33.357Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
        },
        {
          "name": "https://github.com/zalando/skipper/tree/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/tree/v0.27.35"
        }
      ],
      "source": {
        "advisory": "GHSA-5gpm-rgj3-9q76",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86043",
    "datePublished": "2026-09-16T18:51:20.486Z",
    "dateReserved": "2026-09-04T19:29:21.058Z",
    "dateUpdated": "2026-09-16T19:38:17.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54247 (GCVE-0-2026-54247)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:04 – Updated: 2026-09-16 16:19

Title

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 16:19 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4053	x_refsource_MISC
https://github.com/zalando/skipper/commit/c3d156c…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.26.22

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:19:01.486253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:19:12.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:04:06.550Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-cwxq-rc9x-2jvv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-cwxq-rc9x-2jvv"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4053",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4053"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/c3d156c6caaefecc9a46774c0f9c3c70b97160b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/c3d156c6caaefecc9a46774c0f9c3c70b97160b4"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.26.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.26.22"
        }
      ],
      "source": {
        "advisory": "GHSA-cwxq-rc9x-2jvv",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54247",
    "datePublished": "2026-09-14T20:04:06.550Z",
    "dateReserved": "2026-06-12T16:25:43.085Z",
    "dateUpdated": "2026-09-16T16:19:12.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54246 (GCVE-0-2026-54246)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:03 – Updated: 2026-09-15 14:38

Title

Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 14:38 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4056	x_refsource_MISC
https://github.com/zalando/skipper/commit/fb3d5f9…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:38:31.741550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:38:38.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:03:14.613Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4056",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4056"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/fb3d5f98ee749d9a1dfc5df2d51ac9b82fab92aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/fb3d5f98ee749d9a1dfc5df2d51ac9b82fab92aa"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.13"
        }
      ],
      "source": {
        "advisory": "GHSA-5587-2x54-jj6h",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54246",
    "datePublished": "2026-09-14T20:03:14.613Z",
    "dateReserved": "2026-06-12T16:25:43.085Z",
    "dateUpdated": "2026-09-15T14:38:38.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65838 (GCVE-0-2026-65838)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:01 – Updated: 2026-09-15 13:55

Title

Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:26 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/2cfceab…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.27.35

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:26:56.403629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:55:41.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.35"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:01:27.862Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
        }
      ],
      "source": {
        "advisory": "GHSA-8qqm-fp2q-v734",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65838",
    "datePublished": "2026-09-14T20:01:27.862Z",
    "dateReserved": "2026-07-22T23:16:47.753Z",
    "dateUpdated": "2026-09-15T13:55:41.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65604 (GCVE-0-2026-65604)

Vulnerability from cvelistv5 – Published: 2026-07-23 21:16 – Updated: 2026-07-24 14:04

Title

Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Summary

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 14:03 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/skipper-inco…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	cpe:2.3:a:zalando:skipper::::::::

Date Public

2026-07-09 00:00

Credits

sec-reex

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65604",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T14:03:58.021319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T14:04:07.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "skipper",
          "vendor": "zalando"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "sec-reex"
        }
      ],
      "datePublic": "2026-07-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T21:16:47.608Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-8qqm-fp2q-v734)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
        },
        {
          "name": "VulnCheck Advisory: Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass"
        }
      ],
      "title": "Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-65604",
    "datePublished": "2026-07-23T21:16:47.608Z",
    "dateReserved": "2026-07-22T10:48:36.000Z",
    "dateUpdated": "2026-07-24T14:04:07.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50197 (GCVE-0-2026-50197)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:23 – Updated: 2026-07-20 14:33

Title

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 14:33 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/pull/4041	x_refsource_MISC
https://github.com/zalando/skipper/commit/3152f3b…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.26.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50197",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T14:33:19.738683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T14:33:29.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper\u0027s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:23:43.574Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"
        },
        {
          "name": "https://github.com/zalando/skipper/pull/4041",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/pull/4041"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.26.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.26.10"
        }
      ],
      "source": {
        "advisory": "GHSA-659f-rgp5-w4wf",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50197",
    "datePublished": "2026-07-17T19:23:43.574Z",
    "dateReserved": "2026-06-03T22:05:13.645Z",
    "dateUpdated": "2026-07-20T14:33:29.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24470 (GCVE-0-2026-24470)

Vulnerability from cvelistv5 – Published: 2026-01-26 22:23 – Updated: 2026-01-27 14:51

Title

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-27 14:50 UTC

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/a4c87ce…	x_refsource_MISC
https://kubernetes.io/docs/concepts/services-netw…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.24.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T14:50:06.337869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T14:51:35.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper\u0027s network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T22:23:43.325Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219"
        },
        {
          "name": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname"
        }
      ],
      "source": {
        "advisory": "GHSA-mxxc-p822-2hx9",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24470",
    "datePublished": "2026-01-26T22:23:43.325Z",
    "dateReserved": "2026-01-23T00:38:20.546Z",
    "dateUpdated": "2026-01-27T14:51:35.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23742 (GCVE-0-2026-23742)

Vulnerability from cvelistv5 – Published: 2026-01-16 20:07 – Updated: 2026-01-16 20:24

Title

Skipper arbitrary code execution through lua filters

Summary

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-16 20:22 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-250 - Execution with Unnecessary Privileges
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/0b52894…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v0.23.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zalando	skipper	Affected: < 0.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T20:22:53.499072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-16T20:24:12.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T20:07:46.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.23.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.23.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cc8m-98fm-rc9g",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper arbitrary code execution through lua filters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23742",
    "datePublished": "2026-01-16T20:07:46.746Z",
    "dateReserved": "2026-01-15T15:45:01.958Z",
    "dateUpdated": "2026-01-16T20:24:12.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-38580 (GCVE-0-2022-38580)

Vulnerability from cvelistv5 – Published: 2022-10-24 00:00 – Updated: 2026-07-09 00:20

Summary

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-07 14:23 UTC

CWE

n/a

Assigner

mitre mitre root

References

3 references

URL	Tags
https://pastebin.com/dXxpgPAK
https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b7…
http://packetstormsecurity.com/files/171546/X-Ski…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:20:56.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pastebin.com/dXxpgPAK"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-38580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T14:23:09.483594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T14:24:29.244Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T15:56:19.950Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://pastebin.com/dXxpgPAK"
        },
        {
          "url": "https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580"
        },
        {
          "url": "http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-38580",
    "datePublished": "2022-10-24T00:00:00.000Z",
    "dateReserved": "2022-08-22T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:20:56.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-34296 (GCVE-0-2022-34296)

Vulnerability from cvelistv5 – Published: 2022-06-22 12:57 – Updated: 2024-08-03 09:07

Summary

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:07:15.958Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-22T12:57:53.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-34296",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/zalando/skipper/releases/tag/v0.13.218",
              "refsource": "MISC",
              "url": "https://github.com/zalando/skipper/releases/tag/v0.13.218"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-34296",
    "datePublished": "2022-06-22T12:57:53.000Z",
    "dateReserved": "2022-06-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T09:07:15.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for skipper by zalando

CVE-2026-86043 (GCVE-0-2026-86043)

CVE-2026-65838 (GCVE-0-2026-65838)

CVE-2026-54247 (GCVE-0-2026-54247)

CVE-2026-54246 (GCVE-0-2026-54246)

CVE-2026-65604 (GCVE-0-2026-65604)

CVE-2026-50197 (GCVE-0-2026-50197)

CVE-2026-24470 (GCVE-0-2026-24470)

CVE-2026-23742 (GCVE-0-2026-23742)

CVE-2022-38580 (GCVE-0-2022-38580)

CVE-2022-34296 (GCVE-0-2022-34296)

CVE-2026-86043 (GCVE-0-2026-86043)

CVE-2026-54247 (GCVE-0-2026-54247)

CVE-2026-54246 (GCVE-0-2026-54246)

CVE-2026-65838 (GCVE-0-2026-65838)

CVE-2026-65604 (GCVE-0-2026-65604)

CVE-2026-50197 (GCVE-0-2026-50197)

CVE-2026-24470 (GCVE-0-2026-24470)

CVE-2026-23742 (GCVE-0-2026-23742)

CVE-2022-38580 (GCVE-0-2022-38580)

CVE-2022-34296 (GCVE-0-2022-34296)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for skipper by zalando

CVE-2026-86043 (GCVE-0-2026-86043)

CVE-2026-65838 (GCVE-0-2026-65838)

CVE-2026-54247 (GCVE-0-2026-54247)

CVE-2026-54246 (GCVE-0-2026-54246)

CVE-2026-65604 (GCVE-0-2026-65604)

CVE-2026-50197 (GCVE-0-2026-50197)

CVE-2026-24470 (GCVE-0-2026-24470)

CVE-2026-23742 (GCVE-0-2026-23742)

CVE-2022-38580 (GCVE-0-2022-38580)

CVE-2022-34296 (GCVE-0-2022-34296)

CVE-2026-86043 (GCVE-0-2026-86043)

CVE-2026-54247 (GCVE-0-2026-54247)

CVE-2026-54246 (GCVE-0-2026-54246)

CVE-2026-65838 (GCVE-0-2026-65838)

CVE-2026-65604 (GCVE-0-2026-65604)

CVE-2026-50197 (GCVE-0-2026-50197)

CVE-2026-24470 (GCVE-0-2026-24470)

CVE-2026-23742 (GCVE-0-2026-23742)

CVE-2022-38580 (GCVE-0-2022-38580)

CVE-2022-34296 (GCVE-0-2022-34296)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.