https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:20:55.686653+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-334639 EUVD-2026-334639 2026-10-03T15:20:55.747480+00:00 EUVD-2026-334639 https://cve.radiocsirt.org/vuln/fkie_cve-2022-38580 fkie_cve-2022-38580 2026-10-03T15:20:55.747517+00:00

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

 https://cve.radiocsirt.org/vuln/ghsa-f2rj-m42r-6jm2 GHSA-f2rj-m42r-6jm2 — Skipper vulnerable to SSRF via X-Skipper-Proxy 2026-10-03T15:20:55.747548+00:00

Affected: Go: github.com/zalando/skipper

### Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

### Patches The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper `>=v0.13.237`.

### Workarounds

Use `dropRequestHeader("X-Skipper-Proxy")` filter

### References

https://github.com/zalando/skipper/releases/tag/v0.13.237

### For more information If you have any questions or comments about this advisory:

* Open an issue in https://github.com/zalando/skipper/issues/new/choose * Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5

 https://cve.radiocsirt.org/vuln/gsd-2022-38580 gsd-2022-38580 2026-10-03T15:20:55.747583+00:00 gsd-2022-38580