Skip to content
OpenAdvisories

Package · Go

github.com/zalando/skipper

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • High 7.5
    CVE-2026-86043

    Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

    Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncate…

    zalando skipper github.com/zalando/skipper Go
  • Medium 4.3
    CVE-2026-54247

    Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

    Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) …

    zalando skipper github.com/zalando/skipper Go
  • Medium 5.7
    CVE-2026-54246

    Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

    Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valk…

    zalando skipper github.com/zalando/skipper Go
  • High 8.2
    CVE-2026-65838

    Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

    Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Reg…

    zalando skipper github.com/zalando/skipper Go
  • High 7.8
    CVE-2026-50197

    Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

    Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-len…

    zalando skipper github.com/zalando/skipper Go
  • High 8.1
    CVE-2026-24470

    Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

    Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to u…

    zalando skipper github.com/zalando/skipper Go
  • High 8.8
    CVE-2026-23742

    Skipper arbitrary code execution through lua filters

    Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example throu…

    zalando skipper github.com/zalando/skipper Go
  • Critical 9.8
    CVE-2022-38580 Public exploit EPSS 16%

    Skipper vulnerable to SSRF via X-Skipper-Proxy

    Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

    github.com/zalando/skipper Go
  • High 7.5
    CVE-2022-34296

    Query predicate bypass in Zalando Skipper

    In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

    github.com/zalando/skipper Go