CyberRota Analysis
AI-GeneratedThe routesrv component in Skipper, an HTTP router and reverse proxy for Kubernetes, is vulnerable due to a lack of application-layer authentication, allowing unauthorized access to sensitive cluster-wide control-plane data. Attackers with access to a compromised pod can exploit this vulnerability to bypass namespace-scoped RBAC, potentially exposing critical information such as Ingress URLs and OAuth details across namespaces. Organizations using affected versions prior to 0.27.13 should prioritize upgrading to mitigate the risk of confidentiality breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, eskipBytes.ServeHTTP in routesrv/eskipbytes.go, RedisHandler.ServeHTTP in routesrv/redishandler.go, and ValkeyHandler.ServeHTTP in routesrv/valkeyhandler.go only restrict HTTP methods and do not authenticate callers. A compromised or otherwise attacker-controlled pod that can reach routesrv on the Kubernetes cluster network can bypass its namespace-scoped RBAC and read Ingress and RouteGroup backend URLs, filter-chain and OAuth or OIDC path details, and Redis or Valkey shard addresses across namespaces. NetworkPolicy can restrict reachability but does not remove the missing-authentication condition, and the established impact is confidentiality exposure rather than direct integrity or availability loss. This issue is fixed in version 0.27.13.