What’s Vulnerable › Products

zalando skipper vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your zalando skipper version is affected

Latest zalando skipper vulnerabilities

• CVE-2026-86043 — Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) (CVSS 7.5)
• CVE-2026-65838 — Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream (CVSS 8.2)
• CVE-2026-54247 — Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS (CVSS 4.3)
• CVE-2026-54246 — Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication (CVSS 5.7)
• CVE-2026-65604 — Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass (CVSS 8.2)
• CVE-2026-50197 — Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests (CVSS 7.8)
• CVE-2026-24470 — Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName (CVSS 8.1)
• CVE-2026-23742 — Skipper arbitrary code execution through lua filters (CVSS 8.8)
• CVE-2022-38580 — (CVSS 9.8)
• CVE-2022-34296 — (CVSS 7.5)