CVE-2026-54247Medium· 4.3▾ SunlitSkipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/zalando/skipper < 0.26.22Patched in:
github.com/zalando/skipper 0.26.22Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86043High· 7.5Skipper is an HTTP router and reverse proxy for service composition
CVE-2026-65838High· 8.2Skipper is an HTTP router and reverse proxy for service composition
CVE-2026-54246Medium· 5.7Skipper is an HTTP router and reverse proxy for service composition
CVE-2022-27262Critical· 9.8An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
CVE-2025-61726High· 7.5The net/url package does not set a limit on the number of query parameters in a query
CVE-2026-16100Medium· 6.5A flaw was found in the user-event metrics recording of Keycloak