Vulnerabilities

TI-2026-58867 CVE-2026-86043 · GHSA-5gpm-rgj3-9q76

Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

HIGH 72

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00451 Published 2026-09-16 Fixed in 0.27.37 CWE-863

TI-2026-39149 CVE-2026-54247 · GHSA-cwxq-rc9x-2jvv

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

LOW 20

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00298 Published 2026-09-14 Fixed in 0.26.22 CWE-770

TI-2026-39148 CVE-2026-54246 · GHSA-5587-2x54-jj6h

Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

LOW 26

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00338 Published 2026-09-14 Fixed in 0.27.13 CWE-306

TI-2026-46913 CVE-2026-65838 · GHSA-8qqm-fp2q-v734

Improper check for unusual conditions in zalando skipper

MEDIUM 42

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00464 Published 2026-09-14 Fixed in 0.27.35, 0.27.26 CWE-754

TI-2026-46767 CVE-2026-65604 · GHSA-p75f-h73c-3rcp

Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

HIGH 77

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0039 Published 2026-07-23 No fix listed CWE-20

TI-2026-36956 CVE-2026-50197 · GHSA-659f-rgp5-w4wf

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

HIGH 73

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00513 Published 2026-07-17 Fixed in 0.26.10 CWE-444

TI-2026-19725 CVE-2026-24470 · GHSA-mxxc-p822-2hx9

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

LOW 37

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-01-26 Fixed in 0.24.0 CWE-441

TI-2026-19115 CVE-2026-23742 · GHSA-cc8m-98fm-rc9g

Skipper arbitrary code execution through lua filters

MEDIUM 41

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2026-01-16 Fixed in 0.23.0 CWE-250

TI-2022-18154 CVE-2022-38580 · GHSA-f2rj-m42r-6jm2

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

HIGH 65

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15892 Published 2022-10-24 Fixed in 0.13.237 CWE-918

TI-2022-15208 CVE-2022-34296 · GHSA-qx2j-85q5-ffp8

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

LOW 35

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0115 Published 2022-06-22 Fixed in 0.13.218

Vulnerabilities

Filters