CVE-2026-23742
High · 8.8CVSS
8.8
EPSS
0.5%
Published
Jan 16, 2026
CISA due date
—
The record
Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zalando/skipper | 0 | 0.23.0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4327 Skipper is vulnerable to arbitrary code execution through lua filters in… Same vulnerability
- GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via… Also affects github.com/zalando/skipper
- CVE-2026-24470 Skipper is an HTTP router and reverse proxy for service composition. Also affects github.com/zalando/skipper
- CVE-2022-38580 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Also affects github.com/zalando/skipper
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb