The vulnerability allows users with permission to create a Kubernetes Ingress resource and a Service of type ExternalName to configure Skipper’s routing to point to internal services. By doing so, an attacker can use the Ingress controller to reach internal resources that are otherwise unreachable from outside the cluster, potentially exposing sensitive data or enabling lateral movement within the environment. This flaw arises from an authorization bypass (CWE-441) and a server‑side request forgery vulnerability (CWE-918).

The issue affects Zalando Skipper when deployed as an Ingress controller. All releases prior to 0.24.0 are vulnerable; versions 0.24.0 and later have disabled the ExternalName handling by default.

The CVSS base score is 8.1, indicating a high severity vulnerability. The EPSS score is below 1 %, suggesting a low probability of exploitation at this time, although the vulnerability is not listed in the CISA KEV catalog. The attack vector requires valid Kubernetes API access to create the specific resources, so the threat is primarily for insiders or compromised nodes that can interact with the API.