zalando skipper

• CVE-2026-86043 High 7.5 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) 0.5%
• CVE-2026-54247 Medium 4.3 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS 0.3%
• CVE-2026-54246 Medium 5.7 Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication 0.3%
• CVE-2026-65838 High 8.2 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream 0.5%
• CVE-2026-65604 High 8.2 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass 0.4%
• CVE-2026-50197 High 7.8 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests 0.5%
• CVE-2026-24470 High 8.1 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName 0.3%
• CVE-2026-23742 High 8.8 Skipper arbitrary code execution through lua filters 0.5%