Zalando vulnerabilities
We track 6 vulnerabilities in Zalando products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Zalando vulnerabilities
- 7.5 High severity
skipper: Incorrect Authorization
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated
- 8.2 High severity
skipper: Improper Check for Unusual or Exceptional Conditions
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego
- 8.2 High severity
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass…
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstr
- 7.8 High severity
skipper: Inconsistent Interpretation of HTTP Requests
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-leng
- 8.1 High severity
skipper: Unintended Proxy or Intermediary
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to us
- 8.8 High severity
skipper: Improper Control of Generation of Code
Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example throug