GO-2026-4378
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zalando/skipper | 0 | 0.24.0 |
Related vulnerabilities
- CVE-2026-24470 Skipper is an HTTP router and reverse proxy for service composition. Same vulnerability
- GO-2026-4327 Skipper is vulnerable to arbitrary code execution through lua filters in… Also affects github.com/zalando/skipper
- CVE-2026-23742 Skipper is an HTTP router and reverse proxy for service composition. Also affects github.com/zalando/skipper
- CVE-2022-38580 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Also affects github.com/zalando/skipper