zalando skipper up to 0.26.10 routesrv-no-auth missing authentication

Summaryinfo

A vulnerability marked as problematic has been reported in zalando skipper. Affected by this vulnerability is an unknown functionality of the component routesrv-no-auth. This manipulation causes missing authentication. This vulnerability appears as CVE-2026-54246. The attacker needs to be present on the local network. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in zalando skipper and classified as problematic. Affected by this vulnerability is an unknown code of the component routesrv-no-auth. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality. The summary by CVE is:

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54246. The exploitation appears to be easy. The attack needs to be initiated within the local network. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.27.13 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• zalando

Name

• skipper

Version

• 0.13.218
• 0.13.236
• 0.23.0
• 0.24.0
• 0.26.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion