CVE-2026-23742: high-severity vulnerability in zalando skipper
Skipper arbitrary code execution through lua filters
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
zalando · skipperRelated CVEs — zalando skipper
In the same product, most dangerous first.
CVE-2026-50197HIGHSkipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requestsEPSS 0.5%CVE-2026-65838HIGHSkipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstreamEPSS 0.5%CVE-2026-86043HIGHSkipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)EPSS 0.5%CVE-2026-65604HIGHSkipper Incomplete Fix for CVE-2026-50197 Policy BypassEPSS 0.4%CVE-2026-54246MEDIUMSkipper routesrv-no-auth: All routesrv API Endpoints Lack AuthenticationEPSS 0.3%CVE-2026-24470HIGHSkipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalNameEPSS 0.3%