CVE-2022-38580

CRITICAL

Zalando Skipper < 0.13.237 - Server-Side Request Forgery

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-38580. PoCs published by Hosein Vita.

AI-analyzed exploit summary This exploit demonstrates an SSRF vulnerability in X-Skipper-Proxy versions prior to v0.13.237. By adding the 'X-Skipper-Proxy' header with a target URL (e.g., AWS metadata service), an attacker can force the server to make arbitrary internal requests.

Description

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

Exploits (1)

exploitdb WORKING POC
by Hosein Vita · textremotemultiple
https://www.exploit-db.com/exploits/51111

This exploit demonstrates an SSRF vulnerability in X-Skipper-Proxy versions prior to v0.13.237. By adding the 'X-Skipper-Proxy' header with a target URL (e.g., AWS metadata service), an attacker can force the server to make arbitrary internal requests.

Classification
Working Poc 100%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: X-Skipper-Proxy < v0.13.237
No auth needed
Prerequisites: Access to a vulnerable Skipper instance · Ability to send HTTP requests with custom headers
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 9.8
EPSS 0.4225
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-918
Status published
Products (2)
zalando/skipper < 0.13.237
zalando/skipper 0 - 0.13.237Go
Published Oct 25, 2022
Tracked Since Feb 18, 2026