Skipper
CVE-2026-24470
HIGH
GHSA-mxxc-p822-2hx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate Ingress with ExternalName Service
-
ExploitSkipper routes traffic through proxy
-
ImpactAccess internal services via network bridge
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Kubernetes cluster running Skipper < 0.24.0 as Ingress controller with ExternalName Services enabled. Attacker requires create permissions for Ingress and Service resources (authenticated Kubernetes user). |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to list targets of an ExternalName and allow list via regular expressions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Skipper versions up to 0.24.0 contains a vulnerability that allows attackers to list targets of an ExternalName and allow list via regular expressions (CVSS 8.1).
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
affects Skipper. Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
Know when Skipper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
Executive ViewAI
Skipper versions up to 0.24.0 contain a vulnerability (CVSS 8.1) that enables attackers to enumerate ExternalName service targets and bypass allowlist controls through regex manipulation. Organizations using affected Skipper versions face exposure of internal service architecture and potential unauthorized access to backend services.
Apply vendor patch. If patch deployment is delayed, restrict network access to Skipper admin/API endpoints using firewall rules or network segmentation, disable ExternalName functionality if not operationally required, and implement enhanced logging to detect enumeration attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Rated critical severity (CVSS 9.8), this
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary
Skipper versions before 0.23.0 allow authenticated users with Ingress resource creation privileges to execute arbitrary
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. Rated high severity (CVS
Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open
Authorization bypass in Zalando Skipper's `opaAuthorizeRequestWithBody` filter allows unauthenticated remote attackers t
Authorization bypass in Zalando Skipper before 0.27.37 lets unauthenticated remote attackers slip an oversized request b
Exploit-DB