Security Flaw in Skipper HTTP Router by Zalando

CVE-2026-23742

What is CVE-2026-23742?

The Skipper HTTP router, used for service composition, has a vulnerability associated with its default configuration before version 0.23.0. Specifically, the -lua-sources parameter allows untrusted users to create and inject Lua filters. This poses a risk as attackers could exploit this feature through a Kubernetes Ingress resource, resulting in unauthorized access to the underlying filesystem. If they manage to read the logs, they could also access sensitive secrets stored within Skipper. The issue is rectified in Skipper version 0.23.0, which is recommended for enhanced security.

References