Read the docs
TI-2026-19115 Aliases CVE-2026-23742GHSA-cc8m-98fm-rc9g

Skipper arbitrary code execution through lua filters

Priority MEDIUM 41CWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-250, CWE-522 and CWE-94.

Summary

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed skipper (zalando): 0.23.0github.com/zalando/skipper (Go): 0.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zalandoskipperbefore 0.23.00.23.0Patch availableCNA
—github.com/zalando/skipper (Go)before 0.23.00.23.0Patch availableGHSA-cc8m-98fm-rc9g
  • skipper Vendorzalando Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA
  • github.com/zalando/skipper (Go) Vendor— Affected before 0.23.0 Fixed in 0.23.0 Patch available GHSA-cc8m-98fm-rc9g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:*before 0.23.0Vulnerablezalando
  • cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:* Versions before 0.23.0 Vulnerable ·zalando

Remediation

  • Fix · CNA skipper (zalando) Fixed in 0.23.0
  • Fix · GHSA-cc8m-98fm-rc9g github.com/zalando/skipper (Go) Fixed in 0.23.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23742
  2. 2026-10-03 Alias added: GHSA-cc8m-98fm-rc9g

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2022-18154 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.8
  • TI-2026-19725 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName CVSS 3.1HIGH 8.1
  • TI-2022-15208 In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences