CVE-2026-54246

CVE-2026-54246 affects the routesrv component of Skipper (Zalando's HTTP router and reverse proxy). Prior to version 0.27.13 , routesrv serves cluster-wide control-plane data—Ingress/RouteGroup backend URLs, filter-chain and OAuth/OIDC path details, and Redis/Valkey shard addresses—over plain HTT...

CVE-2026-54246 Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...