Login Request a demo
SK
Product
skipper
by zalando · last CVE Sep 16, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 7Medium 2Low 0
Severity
All severities10Critical1High7Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add skipper to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-38580
9.8
16%
Oct 24
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF)
Affected: before 0.13.237
CVE-2026-23742
8.8
1%
Jan 16
Skipper arbitrary code execution through lua filters
Affected: < 0.23.0
CVE-2026-65838
8.2
0%
Sep 14
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream
Affected: < 0.27.35
CVE-2026-65604
8.2
0%
Jul 23
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
Affected: All versions, or not specified
CVE-2026-24470
8.1
0%
Jan 26
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
Affected: < 0.24.0
CVE-2026-50197
7.8
1%
Jul 17
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
Affected: < 0.26.10
CVE-2026-86043
7.5
0%
Sep 16
Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Affected: < 0.27.37
CVE-2022-34296
7.5
1%
Jun 22
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request
Affected: before 0.13.218
CVE-2026-54246
5.7
0%
Sep 14
Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication
Affected: < 0.27.13
CVE-2026-54247
4.3
0%
Sep 14
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Affected: < 0.26.22
Showing 10