https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:59:22.592096+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266651 EUVD-2026-266651 2026-10-06T16:59:22.649090+00:00 EUVD-2026-266651 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24470 fkie_cve-2026-24470 2026-10-06T16:59:22.649135+00:00

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

 https://cve.radiocsirt.org/vuln/ghsa-mxxc-p822-2hx9 GHSA-mxxc-p822-2hx9 — Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName 2026-10-06T16:59:22.649187+00:00

Affected: Go: github.com/zalando/skipper

### Impact

When running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services.

### Patches

https://github.com/zalando/skipper/releases/tag/v0.24.0 disables Kubernetes ExternalName by default.

### Workarounds

Developers can allow list targets of an ExternalName by using `-kubernetes-only-allowed-external-names=true` and allow list via regular expressions `-kubernetes-allowed-external-name '^[a-z][a-z0-9-.]+[.].allowed.example$'`

### References

https://kubernetes.io/docs/concepts/services-networking/service/#externalname