Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54246— Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Quick assessment

Affected
zalando skipper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Skipper 是用于服务组合（service composition）的 HTTP 路由器和反向代理。在 0.27.13 版本之前，routesrv 组件通过 、 、 和 端点提供整个集群范围内的控制平面数据，但未启用应用层身份验证。 具体而言， 中注册的处理程序、 中的 、 中的 以及 中的 仅限制了 HTTP 方法，但未对调用方进行身份验证。 因此，一个被攻陷或受攻击者控制的、能够访问 Kubernetes 集群网络中 routesrv 的 Pod，可以绕过其命名空间范围内的 RBAC（基于角色的访问控制），

CVSS 5.7 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54246

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zalando skipper < 0.27.13 -

II. Public POCs for CVE-2026-54246

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54246

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-54246 (1)

Vendor Pages for CVE-2026-54246 (1)

Same Patch Batch · zalando · 2026-09-14 · 3 CVEs total

CVE-2026-65838 8.2 HIGH Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body
CVE-2026-54247 4.3 MEDIUM Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

IV. Related Vulnerabilities

Same product: skipper
Same vendor: zalando
Same weakness: CWE-306

V. Comments for CVE-2026-54246

No comments yet

Leave a comment