CVE-2026-24470 json
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
published 2026-01-26 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4831 , GHSA-mxxc-p822-2hx9 , GO-2026-4378
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
Patch / fix
- go github.com/zalando/skipper 0.24.0
- zalando skipper 0.24.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260205T172317-150000.1.146.1
suse advisories SUSE-SU-2026:0403-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/zalando/skipper | <0.24.0 |
0.24.0 |
Affected products
- zalando skipper
Classification
References
-
github.com
/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219
web, patch
-
github.com
/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9
web, mitigation, vendor-advisory, advisory
-
kubernetes.io
/docs/concepts/services-networking/service/#externalname
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2026-24470
advisory
-
github.com
/zalando/skipper
package
-
github.com
/zalando/skipper/releases/tag/v0.24.0
web
Sources
- CVE List CVE-2026-24470
- GitHub Advisory GHSA-mxxc-p822-2hx9
- NVD CVE-2026-24470
- OSV GO-2026-4378
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.