CVE-2026-23742 Skipper arbitrary code execution through lua filters

What is CVE-2026-23742?

CVE-2026-23742 is a high-severity code injection vulnerability in zalando skipper, published on 16 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.

Weakness: CWE-94, CWE-522, CWE-250

Which versions are affected by CVE-2026-23742?

3 open source packages ship an affected version, including github.com/zalando/skipper. It affects 1 product.

Products include Zalando Skipper.

How do I fix CVE-2026-23742?

Upgrade github.com/zalando/skipper to 0.23.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-23742 being exploited?

There is no known exploitation of CVE-2026-23742 in the wild and no public exploit code.

Other vulnerabilities in zalando skipper

• CVE-2022-38580 Skipper vulnerable to SSRF via X-Skipper-Proxy Critical 9.8
• CVE-2026-24470 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName High 8.1
• CVE-2022-34296 Query predicate bypass in Zalando Skipper High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cc8m-98fm-rc9g, GO-2026-4327.