zalando skipper vulnerabilities
8 published CVEs name zalando skipper among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 0Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-86043
Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
zalando · skipper
High7.5 - CVE-2026-54247
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
zalando · skipper
Medium4.3 - CVE-2026-54246
Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication
zalando · skipper
Medium5.7 - CVE-2026-65838
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream
zalando · skipper
High8.2 - CVE-2026-65604
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
zalando · skipper
High8.8 - CVE-2026-50197
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
zalando · skipper
High7.8 - CVE-2026-24470
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
zalando · skipper
High8.1 - CVE-2026-23742
Skipper arbitrary code execution through lua filters
zalando · skipper
High8.8