EUVD-2026-334639

fkie_cve-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

GHSA-f2rj-m42r-6jm2 — Skipper vulnerable to SSRF via X-Skipper-Proxy

Affected: Go: github.com/zalando/skipper

### Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

### Patches The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper `>=v0.13.237`.

### Workarounds

Use `dropRequestHeader("X-Skipper-Proxy")` filter

### References

https://github.com/zalando/skipper/releases/tag/v0.13.237

### For more information If you have any questions or comments about this advisory:

* Open an issue in https://github.com/zalando/skipper/issues/new/choose * Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5

Most recent entries from all

EUVD-2026-334639

fkie_cve-2022-38580

GHSA-f2rj-m42r-6jm2 — Skipper vulnerable to SSRF via X-Skipper-Proxy

gsd-2022-38580