CRITICAL10.0CVE-2026-50197Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests from 0, < 0.26.10
CRITICAL9.8CVE-2022-38580Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper from 0, < 0.13.237
CRITICAL9.8CVE-2022-38580Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper from 0, < 0.13.237
HIGH8.8Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
from 0, < 0.23.0
HIGH8.8Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
from 0, < 0.23.0
HIGH8.1Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
from 0, < 0.24.0
HIGH8.1Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
from 0, < 0.24.0
HIGH7.5Query predicate bypass in Zalando Skipper in github.com/zalando/skipper
from 0, < 0.13.218
HIGH7.5Query predicate bypass in Zalando Skipper in github.com/zalando/skipper
from 0, < 0.13.218
MEDIUM5.7Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication
from 0, < 0.27.13
MEDIUM4.3Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
from 0, < 0.26.22