zalando has 8 CVEs on record. Cadence is steady at roughly 4 per quarter. The busiest recent month was July 2026 with 4. The median CVSS is 8.2 (high). None have a confirmed exploitation report. Most affected products: skipper (5), github.com/zalando/skipper (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 4
Products
- skipper 5
- github.com/zalando/skipper 3
Worst active — by depth score
CVE-2026-65604High· 8.2Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies57CVE-2026-86043High· 7.5Skipper is an HTTP router and reverse proxy for service composition53CVE-2026-50197High· 8.7Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests48CVE-2026-65838High· 8.2Skipper is an HTTP router and reverse proxy for service composition45GHSA-8qqm-fp2q-v734High· 8.2Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies45
zalando vulnerabilities
CVEs affecting zalando, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-86043High· 7.5PoCSkipper is an HTTP router and reverse proxy for service composition
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent beca…
CVE-2026-65838High· 8.2Skipper is an HTTP router and reverse proxy for service composition
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass …
CVE-2026-54246Medium· 5.7Skipper is an HTTP router and reverse proxy for service composition
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/s…
CVE-2026-54247Medium· 4.3Skipper is an HTTP router and reverse proxy for service composition
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly …
CVE-2026-65604High· 8.2PoCSkipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the fu…
GO-2026-6019NoneSkipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
GHSA-8qqm-fp2q-v734High· 8.2Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
CVE-2026-50197High· 8.7Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests