Vulnerability details
CVE-2026-65838
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream
Official description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| zalando | skipper | < 0.27.35 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734 x_refsource_CONFIRM
- https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507 x_refsource_MISC
- https://github.com/zalando/skipper/releases/tag/v0.27.35 x_refsource_MISC
Details
- Published
- 2026-09-14
- Last updated
- 2026-09-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-754Improper Check for Unusual or Exceptional Conditions