Vulnerabilities

TI-2026-19725 CVE-2026-24470 · GHSA-mxxc-p822-2hx9

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

LOW 37

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-01-26 Fixed in 0.24.0 CWE-441

TI-2026-19115 CVE-2026-23742 · GHSA-cc8m-98fm-rc9g

MEDIUM 41

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2026-01-16 Fixed in 0.23.0 CWE-250

TI-2022-18154 CVE-2022-38580 · GHSA-f2rj-m42r-6jm2

HIGH 65

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15892 Published 2022-10-24 Fixed in 0.13.237 CWE-918

TI-2022-15208 CVE-2022-34296 · GHSA-qx2j-85q5-ffp8

LOW 35

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0115 Published 2022-06-22 Fixed in 0.13.218