CVE-2026-24470 HIGH

CVE-2026-24470: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

Vendor Zalando
Product skipper
Weakness CWE-441
Published January 26, 2026
Last update January 27, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Key dates

02Disclosure timeline

January 26, 2026 CVE published
January 27, 2026 Record updated