CVE-2026-23742
published 2026-01-16CVE-2026-23742: Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.47%
37.4th percentile
Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zalando_skipper | >= 0 < 0.23.0 | 0.23.0 |
| zalando | skipper | < 0.23.0 | 0.23.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
osv·2026-02-03
CVE-2026-23742 Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
GHSA
Skipper is vulnerable to arbitrary code execution through lua filters
ghsa·2026-01-16
CVE-2026-23742 [HIGH] CWE-250 Skipper is vulnerable to arbitrary code execution through lua filters
Skipper is vulnerable to arbitrary code execution through lua filters
### Impact
Arbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).
The default skipper configuration before v0.23 was `-lua-sources=inline,file`.
The problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.
Kubernetes example (vulnerability is not limited to Kubernetes)
```lua
function request(ctx, params)
local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/toke
OSV
Skipper is vulnerable to arbitrary code execution through lua filters
osv·2026-01-16
CVE-2026-23742 [HIGH] Skipper is vulnerable to arbitrary code execution through lua filters
Skipper is vulnerable to arbitrary code execution through lua filters
### Impact
Arbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).
The default skipper configuration before v0.23 was `-lua-sources=inline,file`.
The problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.
Kubernetes example (vulnerability is not limited to Kubernetes)
```lua
function request(ctx, params)
local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/toke
No detection rules found.
No public exploits indexed.
2026-01-16
Published