CVE-2026-23742
📋 TL;DR
CVE-2026-23742 allows attackers with ability to create Lua filters in Skipper to read arbitrary files accessible to the Skipper process, potentially exposing sensitive secrets. This affects Skipper deployments where untrusted users can create Lua filters through interfaces like Kubernetes Ingress resources. The vulnerability exists due to the default '-lua-sources=inline,file' configuration.
💻 Affected Systems
- Skipper HTTP router and reverse proxy
📦 What is this software?
Skipper by Zalando
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Skipper secrets and sensitive files, leading to lateral movement, data exfiltration, or service disruption.
Likely Case
Unauthorized reading of configuration files, logs, and secrets stored in accessible filesystems.
If Mitigated
Limited impact if proper access controls prevent untrusted users from creating Lua filters.
🎯 Exploit Status
Exploitation requires ability to create Lua filters. No public exploit code identified, but the vulnerability is straightforward to exploit given the prerequisite access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.23.0
Vendor Advisory: https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g
Restart Required: Yes
Instructions:
1. Update Skipper to version 0.23.0 or later. 2. Restart Skipper services. 3. Verify the new version is running with 'skipper -version'.
🔧 Temporary Workarounds
Remove inline Lua source
allModify Skipper configuration to remove 'inline' from -lua-sources parameter
skipper -lua-sources=file
Restrict Lua filter creation
allImplement access controls to prevent untrusted users from creating Lua filters
🧯 If You Can't Patch
- Implement strict access controls to prevent untrusted users from creating Lua filters
- Monitor for suspicious Lua filter creation attempts and file read operations
🔍 How to Verify
Check if Vulnerable:
Check Skipper version with 'skipper -version' and verify if below 0.23.0. Also check configuration for '-lua-sources=inline'.Check Version:
skipper -versionVerify Fix Applied:
Confirm Skipper version is 0.23.0 or higher with 'skipper -version'. Verify configuration no longer includes '-lua-sources=inline' or has been properly secured.📡 Detection & Monitoring
Log Indicators:
- Unauthorized Lua filter creation attempts
- Unexpected file read operations from Skipper process
Network Indicators:
- Suspicious requests to Lua filter endpoints
SIEM Query:
process:skipper AND (event:lua_filter_creation OR file_read:unexpected)