CVE-2026-24470: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
Vulnerability summary
CVE-2026-24470 is a high (CVSS 8.1) Unintended Proxy or Intermediary vulnerability in zalando skipper. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.
Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 26-01-2026PublishedVulnerability first disclosed.
- 27-01-2026Last modifiedVulnerability information updated.
Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.31% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-441Unintended Proxy or IntermediaryThe product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
- CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/zalando1 product
- skipper< 0.24.0
Zalando1 product
- skipper< 0.24.0
2 vendors · 2 products
References
6 links- github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9X Refsource CONFIRMWEBAdvisoryMitigationVendor Advisory
- github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219X Refsource MISCWEBFIXPatch
- github.com/zalando/skipperPACKAGE