High · published January 16, 2026
⚡ A single untrusted Lua script could read sensitive secrets from your Skipper proxy! This vulnerability looms in configurations before version 0.23.0, where improper handling of Lua sources opens the door to danger. 🔥 Think of it like a restaurant that allows customers to write their own recipes in the kitchen. If they can whip up any concoction, they might sneak in a recipe that lets them access the chef's secret stash of ingredients — or in this case, your sensitive data! An attacker with the ability to create Lua filters could exploit this flaw to read file systems accessible to the Skipper process. This means they could potentially access and leak sensitive data including Skipper secrets, leading to a significant breach of trust and security. The ramifications could be absolutely devastating if secrets fall into the wrong hands!
Think of it like a restaurant that allows customers to write their own recipes in the kitchen. If they can whip up any concoction, they might sneak in a recipe that lets them access the chef's secret stash of ingredients — or in this case, your sensitive data! This vulnerability arises from the default configuration of Skipper allowing untrusted users to create Lua filters via the inline flag, enabling them to execute scripts that can read files on the server, including sensitive log data.
An attacker with the ability to create Lua filters could exploit this flaw to read file systems accessible to the Skipper process. This means they could potentially access and leak sensitive data including Skipper secrets, leading to a significant breach of trust and security. The ramifications could be absolutely devastating if secrets fall into the wrong hands! Upgrade Skipper to version 0.23.0 immediately to eliminate this vulnerability. Additionally, review your Kubernetes Ingress resources to restrict untrusted users from creating Lua filters. Implement strict access controls on sensitive logs and files as a precaution. You've got this! Follow these steps, and you'll have your Skipper secured in no time. 🛡️