GO-2026-4327
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zalando/skipper | 0 | 0.23.0 |
Related vulnerabilities
- CVE-2026-23742 Skipper is an HTTP router and reverse proxy for service composition. Same vulnerability
- GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via… Also affects github.com/zalando/skipper
- CVE-2026-24470 Skipper is an HTTP router and reverse proxy for service composition. Also affects github.com/zalando/skipper
- CVE-2022-38580 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Also affects github.com/zalando/skipper