How severe is CVE-2022-38580?

CVE-2022-38580 has a CVSS score of 9.8/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by CVE-2022-38580?

CVE-2022-38580 affects the following packages: github.com/zalando/skipper (Go). Ecosystems affected: Go.

How do I fix CVE-2022-38580?

Update github.com/zalando/skipper to 0.13.237 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-38580 is resolved across your whole dependency graph.

How do I detect CVE-2022-38580 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zalando/skipper, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-38580 if there is no patch (or I can't update yet)?

Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Is CVE-2022-38580 actively exploited in the wild?

Yes. There are 1 known exploit references for CVE-2022-38580, including 1 documented proof-of-concept exploit on Exploit-DB. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2022-38580?

CVE-2022-38580 has an EPSS (Exploit Prediction Scoring System) score of 15.9%, placing it in the 97th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score warrants monitoring and prompt remediation.

What type of vulnerability is CVE-2022-38580?

CVE-2022-38580 is classified as Server-Side Request Forgery (SSRF) (CWE-918). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2022-38580 published, and has it been updated?

CVE-2022-38580 was published on October 24, 2022 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

CRITICAL severity

CVE-2022-38580 — skipper

CRITICALFix: zalando/skipper#2058

CVE-2022-38580 is a critical-severity (CVSS 9.8) Server-Side Request Forgery (SSRF) vulnerability in github.com/zalando/skipper. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for github.com/zalando/skipper — see the affected versions and patch details below.

Skipper vulnerable to SSRF via X-Skipper-Proxy

Also known asGHSA-f2rj-m42r-6jm2GO-2022-1086

Published

Oct 24, 2022

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

1 known

Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
A successful exploit gives an attacker total control of the affected component, not partial access.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-38580.

EPSS Exploitation Probability

via FIRST.org ↗

15.9%probability of exploitation in next 30 days

Moderate Risk+3.94%

Lower risk than most CVEs97th percentile — riskier than 97% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

🐹github.com/zalando/skipper

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

Patches

The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper >=v0.13.237.

Workarounds

Use dropRequestHeader("X-Skipper-Proxy") filter

References

https://github.com/zalando/skipper/releases/tag/v0.13.237

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/zalando/skipper/issues/new/choose
Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/zalando/skipper`	all versions	0.13.237`go get github.com/zalando/skipper@v0.13.237`

Affected Products

1 product · 1 configurations

Application

skipperzalando

< 0.13.237

range

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-51111remotemultiple

X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)

by Hosein Vita · Mar 28, 2023

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zalando/skipper, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/zalando/skipper to 0.13.237 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-38580 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

### Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request. ### Patches The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper `>=v0.13.237`. ### Workarounds Use `dropRequestHeader("X-Skipper-Proxy")` filter ### References https://github.com/zalando/skipper/releases/tag/v0.13.237 ### For mo