Read the docs
TI-2026-39148 Aliases CVE-2026-54246GHSA-5587-2x54-jj6h

Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Priority LOW 26CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed skipper (zalando): 0.27.13github.com/zalando/skipper (Go): 0.27.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zalandoskipperbefore 0.27.130.27.13Patch availableCNA
—github.com/zalando/skipper (Go)before 0.27.130.27.13Patch availableGHSA-5587-2x54-jj6h
  • skipper Vendorzalando Affected before 0.27.13 Fixed in 0.27.13 Patch available CNA
  • github.com/zalando/skipper (Go) Vendor— Affected before 0.27.13 Fixed in 0.27.13 Patch available GHSA-5587-2x54-jj6h

Remediation

  • Fix · CNA skipper (zalando) Fixed in 0.27.13
  • Fix · GHSA-5587-2x54-jj6h github.com/zalando/skipper (Go) Fixed in 0.27.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54246
  2. 2026-10-03 Alias added: GHSA-5587-2x54-jj6h

References

Other 5

  • TI-2026-46767 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass CVSS 4.0HIGH 8.8
  • TI-2026-36956 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests CVSS 4.0HIGH 7.8
  • TI-2026-58867 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) CVSS 3.1HIGH 7.5
  • TI-2022-18154 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.8
  • TI-2026-46913 Improper check for unusual conditions in zalando skipper CVSS 3.1HIGH 8.2
  • TI-2026-19115 Skipper arbitrary code execution through lua filters CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences