CVE-2026-54246: Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication

July 17, 2026

The routesrv component exposes the full cluster route topology (Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths) and cache-cluster topology (Redis/Valkey shard addresses) over plain HTTP with zero authentication. Any pod in the Kubernetes cluster can reach routesrv via its predictable DNS name and retrieve sensitive cluster-wide routing and cache infrastructure data.

References

github.com/advisories/GHSA-5587-2x54-jj6h
github.com/zalando/skipper/releases/tag/v0.27.13
github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h
nvd.nist.gov/vuln/detail/CVE-2026-54246

Code Behaviors & Features

Detect and mitigate CVE-2026-54246 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →