GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

CVE-2026-86043

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:24+00:00| published-proof-of-concept| https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76...

GO-2026-6015 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper...

CVE-2026-50197

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:12+00:00| published-proof-of-concept| https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf 2026-07-23 23:00:19+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mrdww77afc2f 2026-07-23 23:00:45+00:00...

Information Exposure

github.com/zalando/skipper is vulnerable to Information Exposure. The vulnerability is due to the default -lua-sources=inline,file configuration, which allows untrusted users to create inline Lua scripts that can read files accessible to the Skipper process, allowing an attacker to access sensiti...

MAL-2026-729 Malicious code in zalando-consent-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfebb7ed5c3e35afeff037425cd019134eb927484b619019f7d11b13d6fe59c5 The package zalando-consent-api was found to contain malicious code. Source: ghsa-malware...

Malicious code in zalando-consent-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfebb7ed5c3e35afeff037425cd019134eb927484b619019f7d11b13d6fe59c5 The package zalando-consent-api was found to contain malicious code. Source: ghsa-malware...

Malware in zalando-consent-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview zalando-consent-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GO-2026-4327 Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper

Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper...

PT-2026-6504

Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper...

GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper...

Arbitrary Code Injection

Overview github.com/zalando/skipper is a HTTP router and reverse proxy for service composition Affected versions of this package are vulnerable to Arbitrary Code Injection via the default configuration -lua-sources=inline,file. An attacker can execute arbitrary code and access sensitive files by...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

EUVD-2022-6139

Malicious code in bioql PyPI...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

GO-2022-0494 Query predicate bypass in Zalando Skipper in github.com/zalando/skipper

Query predicate bypass in Zalando Skipper in github.com/zalando/skipper...

MAL-2023-1006 Malicious code in zalando-tech-radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bcc871674553b866c3bc29c32b5fab13985f16987aab59fd1869d00d6b1359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in zalando-tech-radar

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in zalando-tech-radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bcc871674553b866c3bc29c32b5fab13985f16987aab59fd1869d00d6b1359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...