Zalando

6 CVEs across 1 Zalando products. Browse Zalando vulnerabilities, severities, and proof-of-concept exploits.

Zalando products with known CVEs

ProductCVEs
Skipper6
Zalando CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-65604High8.22026-07-23Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a r…
CVE-2026-501972026-07-17Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-…
CVE-2026-24470High8.12026-01-26Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permiss…
CVE-2026-23742High8.82026-01-16Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem…
CVE-2022-38580Critical9.82022-10-25Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2022-34296High7.52022-06-23In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.