Zalando
Zalando Skipper: vulnerabilidades y CVE
Zalando Skipper tiene 6 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE6
Últimos 12 meses4
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-65604 | Alta (8.8) | 0.39% | — | 23 jul 2026 | Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit,… |
| CVE-2026-50197 | Alta (7.8) | 0.55% | — | 17 jul 2026 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and… |
| CVE-2026-24470 | Alta (8.1) | 0.31% | — | 26 ene 2026 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName… |
| CVE-2026-23742 | Alta (8.8) | 0.52% | — | 16 ene 2026 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of… |
| CVE-2022-38580 | Crítica (9.8) | 12% | — | 25 oct 2022 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). |
| CVE-2022-34296 | Alta (7.5) | 1.1% | — | 23 jun 2022 | In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.