GitHub Advisoryadvisory · Go

GHSA-mxxc-p822-2hx9 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

HIGH Published 2026-01-26 Modified 2026-01-29 Official page ↗
Aliases
CVE-2026-24470
Ecosystem
Go
Packages
github.com/zalando/skipper
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-441, CWE-918
Reviewed
2026-01-26

Affected packages

• Go github.com/zalando/skipper: < 0.24.0 → fixed in 0.24.0

Description

Impact When running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Patches https://github.com/zalando/skipper/releases/tag/v0.24.0 disables Kubernetes ExternalName by default. Workarounds Developers can allow list targets of an ExternalName by using `-kubernetes-only-allowed-external-names=true` and allow list via regular expressions `-kubernetes-allowed-external-name '^[a-z][a-z0-9-.]+[.].allowed.example$'` References https://kubernetes.io/docs/concepts/services-networking/service/#externalname

Related

Alias · CVE (1)

  • CVE-2026-24470 Skipper is an HTTP router and reverse proxy for service composition. vulnerability

Weakness · CWE (2)

  • CWE-441 Unintended Proxy or Intermediary weakness
  • CWE-918 Server-Side Request Forgery weakness

References