Zalando Skipper
6 CVEs affecting Zalando Skipper. Latest disclosed: 2026-07-23. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38580 | Critical | 9.8 | 2022-10-25 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2026-23742 | High | 8.8 | 2026-01-16 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem… |
CVE-2026-65604 | High | 8.2 | 2026-07-23 | Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a r… |
CVE-2026-24470 | High | 8.1 | 2026-01-26 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permiss… |
CVE-2022-34296 | High | 7.5 | 2022-06-23 | In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. |
CVE-2026-50197 | | 2026-07-17 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-… |