CVE-2026-24470

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

State: Published
Severity: 8.1 High
Published: Jan 26, 2026
Updated: Jan 27, 2026
Reserved: Jan 23, 2026

Description

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
skipperzalando	< 0.24.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.