Zalando Skipper vulnerabilities

• zalando skipper Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) CVE-2026-86043 Fix available 7.5 HighSeptember 16, 2026
• zalando skipper Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass CVE-2026-65604 8.8 HighJuly 23, 2026
• zalando skipper Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream CVE-2026-65838 Fix available 8.2 HighJuly 17, 2026
• zalando skipper Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication CVE-2026-54246 Fix available 5.7 MediumJuly 17, 2026
• zalando skipper Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS CVE-2026-54247 Fix available 4.3 MediumJuly 17, 2026
• zalando skipper Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests CVE-2026-50197 Fix available 7.8 HighJuly 8, 2026
• zalando skipper Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName CVE-2026-24470 Fix available 8.1 HighJanuary 26, 2026
• zalando skipper Skipper arbitrary code execution through lua filters CVE-2026-23742 Fix available 8.8 HighJanuary 16, 2026
• zalando skipper Skipper vulnerable to SSRF via X-Skipper-Proxy CVE-2022-38580 Public exploitFix available EPSS 15.9% 9.8 CriticalOctober 24, 2022
• zalando skipper Query predicate bypass in Zalando Skipper CVE-2022-34296 Fix available 7.5 HighJune 22, 2022