CVE-2026-23742: RCE in Skipper via Lua Filters

The RCE vulnerability in Skipper arises from the lack of proper sanitization and validation of Lua filter input. An attacker who can control or modify the filter configuration can inject arbitrary Lua code. This code will be executed with the privileges of the Skipper process, granting the attacker the ability to read, write, and execute files on the system. Successful exploitation could lead to data exfiltration, denial of service, or even complete takeover of the server hosting Skipper. The impact is particularly severe in environments where Skipper is used to proxy sensitive traffic or manage critical APIs.

1. Reserved2026-01-15
2. Published2026-02-03
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Skipper to version 0.23.0 or later, which includes the necessary fixes to prevent arbitrary code execution. If upgrading immediately is not possible, consider temporarily disabling Lua filters entirely. This can be achieved by removing or commenting out any filter configurations that utilize Lua. As a further precaution, implement strict input validation and sanitization for all filter configurations. Monitor Skipper logs for any suspicious activity related to Lua filter execution. Consider using a Web Application Firewall (WAF) to filter out potentially malicious Lua code.