# CVE-2026-54246: Zalando Skipper missing authentication in routesrv API endpoints

Source: https://junglewise.ai/threats/cve-2026-54246-zalando-skipper-missing-authentication-in-routesrv-api-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-54246 · Severity: medium · CVSS 5.7 · Published 2026-09-14

Zalando Skipper is an HTTP router and reverse proxy for service composition. A security flaw in its route server component allows any application within the same Kubernetes cluster to access sensitive infrastructure data without authentication. An attacker who compromises a single low-privilege application could use this to map out the entire network, identify internal service locations, and potentially access session or rate-limiting data in Redis or Valkey caches.

Technologies: [github.com/zalando/skipper (Go)](https://junglewise.ai/threats/technologies/github-com-zalando-skipper), [Zalando Skipper](https://junglewise.ai/threats/technologies/skipper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Zalando](https://junglewise.ai/threats/vendors/zalando).

## Quick answers

**Is CVE-2026-54246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54246 being exploited in the wild.

**How severe is CVE-2026-54246?** Medium severity, with a CVSS score of 5.7, published 14 September 2026.

**Which products and versions are affected?** github.com/zalando/skipper (Go) < 0.27.13, SEMVER:introduced=0,fixed=0.27.13; Zalando Skipper < 0.27.13.

**Is there a fix for CVE-2026-54246?** Yes. github.com/zalando/skipper (Go): upgrade to 0.27.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54246 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-54246?** Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zalando/skipper (Go): upgrade to 0.27.13 or later

  ```sh
  go get github.com/zalando/skipper@v0.27.13
  ```


## Technical details

The `routesrv` component in Zalando Skipper fails to implement authentication for its HTTP API endpoints, including `/routes`, `/swarm/redis/shards`, and `/swarm/valkey/shards`. Because the component runs with cluster-wide RBAC permissions to aggregate Ingress and RouteGroup data, it inadvertently exposes this sensitive information to any client that can reach its predictable Kubernetes DNS name. An attacker with a foothold in any pod within the cluster can bypass namespace-level isolation to perform reconnaissance on internal service URLs, filter chains (including OAuth/JWT policies), and cache shard addresses. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). A fix is available in version 0.27.13, which introduces authentication capabilities for the route server.

## Affected products

- Zalando skipper < 0.27.13

## Identifiers

- CVE-2026-54246
- GHSA-5587-2x54-jj6h
- GO-2026-6018

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: patched: Version 0.27.13 released
- 2026-07-17: advisory

## References

- [https://api.github.com/users/alcls01111](https://api.github.com/users/alcls01111)
- [https://github.com/alcls01111](https://github.com/alcls01111)
- [https://api.github.com/users/alcls01111/gists%7B/gist_id%7D](https://api.github.com/users/alcls01111/gists%7B/gist_id%7D)
- [https://api.github.com/users/alcls01111/repos](https://api.github.com/users/alcls01111/repos)
- [https://avatars.githubusercontent.com/u/57210489?v=4](https://avatars.githubusercontent.com/u/57210489?v=4)
- [https://api.github.com/users/alcls01111/events%7B/privacy%7D](https://api.github.com/users/alcls01111/events%7B/privacy%7D)

## Related threats

- [Skipper OPA body-authz bypass in chunked/HTTP-2 requests](https://junglewise.ai/threats/cve-2026-86043-skipper-opa-body-authz-bypass-in-chunked-http-2-requests)
- [Zalando Skipper OPA request body authorization bypass](https://junglewise.ai/threats/cve-2026-65838-zalando-skipper-opa-request-body-authorization-bypass)
- [Zalando Skipper memory exhaustion DoS in admission webhook](https://junglewise.ai/threats/cve-2026-54247-zalando-skipper-memory-exhaustion-dos-in-admission-webhook)
- [Zalando Skipper OPA policy bypass via oversized request body](https://junglewise.ai/threats/cve-2026-65604-zalando-skipper-opa-policy-bypass-via-oversized-request-body)
- [Zalando Skipper OPA authorization bypass via HTTP request smuggling](https://junglewise.ai/threats/cve-2026-50197-zalando-skipper-opa-authorization-bypass-via-http-request)