What is CVE-2026-23742?

CVE-2026-23742 is a high-severity vulnerability in Zalando Skipper, classified under Code Injection. CVSS score: 8.8/10. Published 2026-01-16.

How severe is CVE-2026-23742?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Zalando Skipper

CVE-2026-23742

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.000 (8.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zalando Skipper — versions < 0.23.0

Weakness classification (CWE)

References

https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g (x_refsource_CONFIRM)
https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714 (x_refsource_MISC)
https://github.com/zalando/skipper/releases/tag/v0.23.0 (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-23742?: CVE-2026-23742 is a high-severity vulnerability in Zalando Skipper, classified under Code Injection. CVSS score: 8.8/10. Published 2026-01-16.
How severe is CVE-2026-23742?: High severity. CVSS v3 base score is 8.8 out of 10.