zalando/skipper Security Advisories | GitStock

high2026-09-17

Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

GHSA-5gpm-rgj3-9q76 · CVE-2026-86043

high2026-07-17

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

GHSA-8qqm-fp2q-v734 · CVE-2026-65838

medium2026-07-17

Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication

GHSA-5587-2x54-jj6h · CVE-2026-54246

medium2026-07-17

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

GHSA-cwxq-rc9x-2jvv · CVE-2026-54247

high2026-07-08

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

GHSA-659f-rgp5-w4wf · CVE-2026-50197

high2026-01-26

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

GHSA-mxxc-p822-2hx9 · CVE-2026-24470

high2026-01-16

Skipper is vulnerable to arbitrary code execution through lua filters

GHSA-cc8m-98fm-rc9g · CVE-2026-23742

critical2022-10-25

Skipper vulnerable to SSRF via X-Skipper-Proxy

GHSA-f2rj-m42r-6jm2 · CVE-2022-38580

high2022-06-24

Query predicate bypass in Zalando Skipper

GHSA-qx2j-85q5-ffp8 · CVE-2022-34296