CVE-2026-23742: Skipper arbitrary code execution through lua filters

Vulnerability summary

CVE-2026-23742 is a high (CVSS 8.8) Improper Control of Generation of Code vulnerability in zalando skipper. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-01-2026
   PublishedVulnerability first disclosed.
2. 16-01-2026
   Last modifiedVulnerability information updated.

Description

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

• CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.