https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:10:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265966 EUVD-2026-265966 https://cve.radiocsirt.org/vuln/euvd-2026-265966 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23742 <p>Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.</p> <p>Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23742 https://cve.radiocsirt.org/vuln/ghsa-cc8m-98fm-rc9g <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Impact</p> <p>Arbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).</p> <p>The default skipper configuration before v0.23 was `-lua-sources=inline,file`. The problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.</p> <p>Kubernetes example (vulnerability is not limited to Kubernetes) ```lua function request(ctx, params) local file = io.open(&#39;/var/run/secrets/kubernetes.io/serviceaccount/token&#39;, &#39;r&#39;) if file then local token = file:read(&#39;*all&#39;) file:close() error(&#39;[EXFIL] &#39; .. token) -- Exfiltrate via error logs end end ```</p> <p>### Patches</p> <p>https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.</p> <p>### Workarounds</p> <p>You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example `-lua-sources=file` will only be exploitable if the attacker can create a lua script file on the target system.</p> <p>### References</p> <p>https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources</p> <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Impact</p> <p>Arbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).</p> <p>The default skipper configuration before v0.23 was `-lua-sources=inline,file`. The problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.</p> <p>Kubernetes example (vulnerability is not limited to Kubernetes) ```lua function request(ctx, params) local file = io.open(&#39;/var/run/secrets/kubernetes.io/serviceaccount/token&#39;, &#39;r&#39;) if file then local token = file:read(&#39;*all&#39;) file:close() error(&#39;[EXFIL] &#39; .. token) -- Exfiltrate via error logs end end ```</p> <p>### Patches</p> <p>https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.</p> <p>### Workarounds</p> <p>You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example `-lua-sources=file` will only be exploitable if the attacker can create a lua script file on the target system.</p> <p>### References</p> <p>https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources</p> https://cve.radiocsirt.org/vuln/ghsa-cc8m-98fm-rc9g