CVE-2026-54246 Details
Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.
A vulnerability exists in the Zalando Skipper HTTP router and reverse proxy, specifically in the routesrv component, prior to version 0.27.13. The issue arises because routesrv exposes cluster-wide control-plane data over plain HTTP without any application-layer authentication. This vulnerability is present in several endpoints, including '/routes', '/routes/{zone}', '/swarm/redis/shards', and '/swarm/valkey/shards'. The lack of authentication allows a compromised pod within the Kubernetes cluster to bypass namespace-scoped RBAC and access sensitive data, such as Ingress and RouteGroup backend URLs, filter-chain details, and Redis or Valkey shard addresses, across all namespaces.
Users can add authentication to all routesrv HTTP endpoints using basic auth, bearer tokens, mTLS, or shared secrets. Additionally, Kubernetes NetworkPolicies can be deployed to restrict ingress to routesrv, allowing only the data-plane skipper pod selectors to access it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zalando/skipper/commit/fb3d5f98ee749d9a1dfc5df2d51ac9b82fab92aa | [email protected] | Source CodeVendor |
| https://github.com/zalando/skipper/pull/4056 | [email protected] | Issue TrackingVendor |
| https://github.com/zalando/skipper/releases/tag/v0.27.13 | [email protected] | Release NotesVendor |
| https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zalando Skipper | < 0.27.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |