CVE-2026-24470

HIGH

8.1

Description

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Details CVE

Score CVSS v3.18.1

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie1/26/2026

Derniere modification2/18/2026

Sourcenvd

Observations honeypot0

Produits affectes

zalando:skipper

Faiblesses (CWE)

CWE-441CWE-918

References

https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219(security-advisories@github.com)

https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9(security-advisories@github.com)

https://kubernetes.io/docs/concepts/services-networking/service/#externalname(security-advisories@github.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.