Zalando

10 CVEs across 1 Zalando products. Browse Zalando vulnerabilities, severities, and proof-of-concept exploits.

Zalando products with known CVEs

ProductCVEs
Skipper10
Zalando CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-86043High7.52026-09-16Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversize…
CVE-2026-65838High8.22026-09-14Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpo…
CVE-2026-54247Medium4.32026-09-14Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body…
CVE-2026-54246Medium5.72026-09-14Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without ap…
CVE-2026-65604High8.22026-07-23Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a r…
CVE-2026-501972026-07-17Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-…
CVE-2026-24470High8.12026-01-26Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permiss…
CVE-2026-23742High8.82026-01-16Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem…
CVE-2022-38580Critical9.82022-10-25Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2022-34296High7.52022-06-23In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.