Zalando Skipper — known CVE vulnerabilities

Every CVE whose affected-product data names Zalando Skipper, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2022-38580 — CVSS 9.8 (critical): Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
• CVE-2026-23742 — CVSS 8.8 (high): Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was…
• CVE-2026-24470 — CVSS 8.1 (high): Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress…
• CVE-2022-34296 — CVSS 7.5 (high): In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.