Affected by GO-2026-4327
and 5 other vulnerabilities
GO-2026-4327: Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
GO-2026-4378: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
GO-2026-5944: Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper
GO-2026-6015: Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper
GO-2026-6018: Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
GO-2026-6019: Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
New creates a specification for the xforward filter
that appends the remote IP of the incoming request to the
X-Forwarded-For header, and sets the X-Forwarded-Host header
to the value of the incoming request's Host header.
NewFirst creates a specification for the xforwardFirst filter
that prepends the remote IP of the incoming request to the
X-Forwarded-For header, and sets the X-Forwarded-Host header
to the value of the incoming request's Host header.
Affected by 
Documentation
¶
Source Files