https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:16:55.992986+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265966 EUVD-2026-265966 2026-10-06T11:16:56.038996+00:00 EUVD-2026-265966 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23742 fkie_cve-2026-23742 2026-10-06T11:16:56.039034+00:00

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

 https://cve.radiocsirt.org/vuln/ghsa-cc8m-98fm-rc9g GHSA-cc8m-98fm-rc9g — Skipper is vulnerable to arbitrary code execution through lua filters 2026-10-06T11:16:56.039069+00:00

Affected: Go: github.com/zalando/skipper

### Impact

Arbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).

The default skipper configuration before v0.23 was `-lua-sources=inline,file`. The problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.

Kubernetes example (vulnerability is not limited to Kubernetes) ```lua function request(ctx, params) local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r') if file then local token = file:read('*all') file:close() error('[EXFIL] ' .. token) -- Exfiltrate via error logs end end ```

### Patches

https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.

### Workarounds

You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example `-lua-sources=file` will only be exploitable if the attacker can create a lua script file on the target system.

### References

https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources