CVE-2026-24470
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Jan 26, 2026
CISA due date
—
The record
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zalando/skipper | 0 | 0.24.0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via… Same vulnerability
- GO-2026-4327 Skipper is vulnerable to arbitrary code execution through lua filters in… Also affects github.com/zalando/skipper
- CVE-2026-23742 Skipper is an HTTP router and reverse proxy for service composition. Also affects github.com/zalando/skipper
- CVE-2022-38580 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Also affects github.com/zalando/skipper
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb