Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zalando | skipper | before 0.27.37 | 0.27.37 | Patch available | CNA |
| — | github.com/zalando/skipper (Go) | before 0.27.37 | 0.27.37 | Patch available | GHSA-5gpm-rgj3-9q76 |
- skipper Vendorzalando Affected before 0.27.37 Fixed in 0.27.37 Patch available CNA
- github.com/zalando/skipper (Go) Vendor— Affected before 0.27.37 Fixed in 0.27.37 Patch available GHSA-5gpm-rgj3-9q76
Remediation
- Fix · CNA skipper (zalando) Fixed in 0.27.37
- Fix · GHSA-5gpm-rgj3-9q76 github.com/zalando/skipper (Go) Fixed in 0.27.37 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86043
- 2026-10-03 Alias added: GHSA-5gpm-rgj3-9q76
References
Other 6
- https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76
- https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
- https://github.com/zalando/skipper/releases/tag/v0.27.35
- https://github.com/zalando/skipper/tree/v0.27.35
- https://github.com/zalando/skipper
- https://github.com/zalando/skipper/releases/tag/v0.27.37
More zalando vulnerabilities
- TI-2026-46767 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass CVSS 4.0HIGH 8.8
- TI-2026-36956 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests CVSS 4.0HIGH 7.8
- TI-2022-18154 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.8
- TI-2026-46913 Improper check for unusual conditions in zalando skipper CVSS 3.1HIGH 8.2
- TI-2026-19115 Skipper arbitrary code execution through lua filters CVSS 3.1HIGH 8.8
- TI-2026-19725 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName CVSS 3.1HIGH 8.1
Sources
- CVE-2026-86043 · CVE Program
- CVE-2026-86043 · NVD
- FIRST EPSS
- GHSA-5gpm-rgj3-9q76 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences