CVE-2026-54246

Received Received - Intake

Authentication Bypass in Skipper Routesrv

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-54246

Affected Vendors & Products

Vendor	Product	Version / Range
skipper	skipper	to 0.27.13 (exc)
zalando	skipper	to 0.27.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-54246 is a vulnerability in Skipper's routesrv component (versions before 0.27.13) where sensitive cluster routing data is exposed over HTTP without authentication. Attackers with network access to routesrv can read backend URLs, filter chains, OAuth paths, and Redis/Valkey shard addresses across namespaces, bypassing Kubernetes RBAC restrictions.

Detection Guidance

Check if Skipper routesrv endpoints (/routes, /routes/{zone}, /swarm/redis/shards, /swarm/valkey/shards) are accessible without authentication. Use curl commands like: curl -v http://<routesrv-address>/routes or curl -v http://<routesrv-address>/swarm/redis/shards. If responses contain sensitive data without requiring credentials, the system is vulnerable.

Impact Analysis

An attacker could exploit this to extract sensitive routing data, enabling cache-level attacks or further lateral movement within the cluster. While confidentiality is primarily affected, integrity and availability risks are indirect. NetworkPolicy alone does not fully mitigate the issue.

Mitigation Strategies

Upgrade Skipper to version 0.27.13 or later to apply the security fix.
Implement authentication for routesrv endpoints using filter chains or OAuth/OIDC as described in Resources 1 and 2.
Deploy restrictive NetworkPolicies to limit pod-to-pod communication to routesrv, though this does not fully address the authentication flaw.
Use mutual TLS (mTLS) for internal cluster communications to add an additional security layer.

Hi! I’m here to help you understand CVE-2026-54246. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70