CVE-2026-24470
Unknown Unknown - Not Provided

Ingress Controller ExternalName Misconfiguration Enables Unauthorized Internal Access

Publication date: 2026-01-26

Last updated on: 2026-02-18

Assigner: GitHub, Inc.

Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-01-26
Last Modified
2026-02-18
Generated
2026-07-06
AI Q&A
2026-01-27
EPSS Evaluated
2026-07-05
NVD
CVE-2026-24470

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zalando skipper to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Skipper, an HTTP router and reverse proxy used for service composition. Before version 0.24.0, when Skipper was used as an Ingress controller, users who had permissions to create an Ingress and a Service of type ExternalName could create routes that allowed them to use Skipper's network access to reach internal services. This could potentially expose internal services to unauthorized access. Version 0.24.0 addresses this by disabling Kubernetes ExternalName by default, and developers can use allow lists for ExternalName targets as a workaround.

Impact Analysis

This vulnerability can allow users with certain permissions to create routes that use Skipper's network access to reach internal services that might otherwise be inaccessible. This could lead to unauthorized access to internal network resources, potentially exposing sensitive data or internal systems to attackers or unauthorized users.

Mitigation Strategies

To mitigate this vulnerability, upgrade Skipper to version 0.24.0 or later, which disables Kubernetes ExternalName by default. Alternatively, configure Skipper to allow list targets of an ExternalName and allow list via regular expressions to control access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart