CVE-2026-24470

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24470", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T00:38:20.546Z", "datePublished": "2026-01-26T22:23:43.325Z", "dateUpdated": "2026-01-27T14:51:35.229Z"}, "containers": {"cna": {"title": "Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName", "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "lang": "en", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9"}, {"name": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219", "tags": ["x_refsource_MISC"], "url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219"}, {"name": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname", "tags": ["x_refsource_MISC"], "url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname"}], "affected": [{"vendor": "zalando", "product": "skipper", "versions": [{"version": "< 0.24.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:23:43.325Z"}, "descriptions": [{"lang": "en", "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions."}], "source": {"advisory": "GHSA-mxxc-p822-2hx9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T14:50:06.337869Z", "id": "CVE-2026-24470", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:51:35.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T14:50:06.337869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:51:31.267Z"}}], "cna": {"title": "Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName", "source": {"advisory": "GHSA-mxxc-p822-2hx9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zalando", "product": "skipper", "versions": [{"status": "affected", "version": "< 0.24.0"}]}], "references": [{"url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9", "name": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219", "name": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219", "tags": ["x_refsource_MISC"]}, {"url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname", "name": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:23:43.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24470", "state": "PUBLISHED", "dateUpdated": "2026-01-27T14:51:35.229Z", "dateReserved": "2026-01-23T00:38:20.546Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-26T22:23:43.325Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "skipper", "vendor": "zalando", "versions": [{"status": "affected", "version": "< 0.24.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEBBEB5D-B41E-48C3-BF83-F5018AAA9D12", "versionEndExcluding": "0.24.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions."}, {"lang": "es", "value": "Skipper es un router HTTP y proxy inverso para la composici\u00f3n de servicios. Antes de la versi\u00f3n 0.24.0, al ejecutar Skipper como un controlador Ingress, los usuarios con permisos para crear un Ingress y un Servicio de tipo ExternalName pueden crear rutas que les permiten usar el acceso de red de Skipper para alcanzar servicios internos. La versi\u00f3n 0.24.0 deshabilita Kubernetes ExternalName por defecto. Como soluci\u00f3n alternativa, los desarrolladores pueden incluir en la lista de permitidos los objetivos de un ExternalName e incluir en la lista de permitidos mediante expresiones regulares."}], "id": "CVE-2026-24470", "lastModified": "2026-06-17T10:23:07.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24470", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T14:50:06.337869Z", "version": "2.0.3"}}]}, "published": "2026-01-26T23:16:09.123", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:58:34.463471+00:00", "value": {"mitigation_remediation": ["Upgrade Skipper to version 0.24.0 or later", "Configure the cluster to deny creation of ExternalName services or enforce an allow\u2011 of approved targets", "Apply a regular\u2011expression whitelist for ExternalName targets to restrict outbound routing to known internal services"], "summary": {"action": "Patch Immediately", "impact": "Unauthorized access to internal services via ExternalName"}, "threat_synthesis": {"affected_systems": "The issue affects Zalando Skipper when deployed as an Ingress controller. All releases prior to 0.24.0 are vulnerable; versions 0.24.0 and later have disabled the ExternalName handling by default.", "description_and_impact": "The vulnerability allows users with permission to create a Kubernetes Ingress resource and a Service of type ExternalName to configure Skipper\u2019s routing to point to internal services. By doing so, an attacker can use the Ingress controller to reach internal resources that are otherwise unreachable from outside the cluster, potentially exposing sensitive data or enabling lateral movement within the environment. This flaw arises from an authorization bypass (CWE-441) and a server\u2011side request forgery vulnerability (CWE-918).", "risk_and_exploitability": "The CVSS base score is 8.1, indicating a high severity vulnerability. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation at this time, although the vulnerability is not listed in the CISA KEV catalog. The attack vector requires valid Kubernetes API access to create the specific resources, so the threat is primarily for insiders or compromised nodes that can interact with the API."}}}}, "created": "2026-01-27T09:03:12.791192+00:00", "updated": "2026-04-18T15:00:03.454020+00:00", "vendors": ["zalando", "zalando$PRODUCT$skipper"]}