Missing Authentication for Critical Function Affecting github.com/zalando/skipper/routesrv package, versions <0.27.13
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authentication for Critical Function vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMZALANDOSKIPPERROUTESRV-19883916
- published17 Sept 2026
- disclosed14 Sept 2026
- creditalcls01111
Introduced: 14 Sep 2026
NewCVE-2026-54246 Â (opens in a new tab)How to fix?
Upgrade github.com/zalando/skipper/routesrv to version 0.27.13 or higher.
Overview
Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the New HTTP server setup in routesrv/routesrv.go and the /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards handlers. An attacker can read cluster-wide route topology and cache shard addresses by sending plain HTTP requests to the routesrv service from any reachable pod. This exposes internal backend URLs, filter-chain details, and Redis/Valkey infrastructure data, enabling targeted reconnaissance and direct attacks against shared cluster services.
Workarounds
- Deploy Kubernetes
NetworkPolicyrules that restrict ingress to routesrv to only the data-plane skipper pod selectors, so unrelated pods cannot reach the unauthenticated/routes,/routes/{zone},/swarm/redis/shards, and/swarm/valkey/shardsendpoints. - Use mutual TLS between the data-plane and routesrv by enabling
-enable-mtlsand configuring the CA inputs for routesrv, so only clients presenting a trusted certificate can connect to the service.