CVE-2026-23742

Katalog CVE

CVSS 8.8 · High EPSS 0,51%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada zalando skipper. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

Rincian

Terbit di NVD

16 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-250: Execution with Unnecessary Privileges
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g exploit · mitigasi · advisory vendor
• https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714 patch
• https://github.com/zalando/skipper/releases/tag/v0.23.0 product · release notes