CVE-2026-24470 | BDVDB-2026-312489 Detail

Description#

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-01-26Record published in the CVE List.
2. Version 22026-01-27Most recent update recorded in the CVE List.