8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24470

CVE-2026-24470: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Version 0.24.0 disables Kubernetes ExternalName by default. As a workaround, developers can allow list targets of an ExternalName and allow list via regular expressions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24470

CVE-2026-24470:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zalando/skipper	go	< 0.24.0	0.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in how the Skipper Ingress controller handles Kubernetes services of type ExternalName. An attacker with permissions to create Ingress resources could define a service of type ExternalName that points to an internal service. Skipper would then create a route to this internal service, leading to a Server-Side Request Forgery (SSRF) vulnerability. The patch, identified in commit a4c87ce029a58eb8e1c2c1f93049194a39cf6219, introduces a new configuration flag, enable-kubernetes-external-names, which is set to false by default. This change disables the processing of ExternalName services unless an administrator explicitly enables it. The analysis of the patch identified two key functions, kubernetes.convertPathRuleV1 and kubernetes.ingress.convertDefaultBackendV1, in dataclients/kubernetes/ingressv1.go as the locations of the vulnerability. These functions were responsible for creating routes from Ingress definitions and, prior to the patch, lacked the necessary checks to prevent the misuse of ExternalName services. The patch adds a conditional check in both functions to ensure that ExternalName services are only processed if the new flag is enabled.

Vulnerable functions

kubernetes.convertPathRuleV1

dataclients/kubernetes/ingressv1.go

This function is responsible for converting an Ingress path rule into a Skipper route. Before the patch, it would unconditionally process services of type 'ExternalName', creating a route to the specified external service. This allowed users with Ingress creation permissions to forge requests to internal services (SSRF). The patch introduces a check, `ic.enableExternalNames`, which is disabled by default, to prevent the creation of routes from 'ExternalName' services unless explicitly allowed.

kubernetes.ingress.convertDefaultBackendV1

dataclients/kubernetes/ingressv1.go

This method handles the conversion of a default backend specified in an Ingress object into a Skipper route. Similar to `convertPathRuleV1`, this function was vulnerable because it did not validate whether the use of 'ExternalName' services was permitted. It would create a route to any 'ExternalName' service defined as a default backend, enabling an SSRF attack vector. The patch mitigates this by adding a conditional check for `ic.enableExternalNames` before processing the 'ExternalName' service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.