Threats Tagged 'cve-2026-23742'
View all threats tagged with 'cve-2026-23742'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-23742'
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2026-23742 is a high-severity code injection vulnerability in Zalando's Skipper HTTP router and reverse proxy versions prior to 0.23.0. The vulnerability arises from the default configuration allowing inline Lua scripts (-lua-sources=inline,file), which can be exploited if untrusted users can create Lua filters, for example via Kubernetes Ingress resources. Exploitation enables attackers with limited privileges to execute arbitrary Lua code, potentially reading the filesystem accessible to the Skipper process, including sensitive logs and secrets. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires at least low privileges (PR:L) but no user interaction and can be exploited remotely over the network. The issue is fixed in version 0.23.0. Join the discussion | CVE Database V5 | 01/16/2026, 20:07:46 UTC Added: 01/16/2026, 20:21:36 UTC |
Showing 1 to 1 of 1 result