HTTP Router Vulnerability in Skipper by Zalando

CVE-2026-54246

What is CVE-2026-54246?

Skipper, an HTTP router and reverse proxy from Zalando, has a significant vulnerability in its routesrv component. The issue allows unauthorized access to sensitive cluster-wide control-plane data without proper application-layer authentication through specific routes. Attackers with access to the Kubernetes cluster network can potentially exploit this lack of authentication, bypassing namespace-scoped RBAC protections. This could result in exposure of critical information such as Ingress backend URLs, RouteGroup details, and Redis shard addresses. While NetworkPolicy can limit reachability, it does not address the underlying authentication issue. This vulnerability underscores the importance of implementing robust authentication mechanisms to safeguard sensitive data.

References