Vulnerability-Lookup

CVE-2026-65838 (GCVE-0-2026-65838)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:01 – Updated: 2026-09-15 13:55

Title

Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:26 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/zalando/skipper/security/advis…	x_refsource_CONFIRM
https://github.com/zalando/skipper/commit/2cfceab…	x_refsource_MISC
https://github.com/zalando/skipper/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
zalando	skipper	Affected: < 0.27.35	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:26:56.403629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:55:41.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.35"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:01:27.862Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
        },
        {
          "name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
        },
        {
          "name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
        }
      ],
      "source": {
        "advisory": "GHSA-8qqm-fp2q-v734",
        "discovery": "UNKNOWN"
      },
      "title": "Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65838",
    "datePublished": "2026-09-14T20:01:27.862Z",
    "dateReserved": "2026-07-22T23:16:47.753Z",
    "dateUpdated": "2026-09-15T13:55:41.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-65838",
      "date": "2026-09-16",
      "epss": "0.00266",
      "percentile": "0.18892"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-65838\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T20:16:49.103\",\"lastModified\":\"2026-09-16T13:42:48.383\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"zalando\",\"product\":\"skipper\",\"versions\":[{\"version\":\"\u003c 0.27.35\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T13:26:56.403629Z\",\"id\":\"CVE-2026-65838\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"references\":[{\"url\":\"https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/zalando/skipper/releases/tag/v0.27.35\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-65838\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T13:26:56.403629Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T13:26:57.437Z\"}}], \"cna\": {\"title\": \"Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream\", \"source\": {\"advisory\": \"GHSA-8qqm-fp2q-v734\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"zalando\", \"product\": \"skipper\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.27.35\"}]}], \"references\": [{\"url\": \"https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734\", \"name\": \"https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507\", \"name\": \"https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zalando/skipper/releases/tag/v0.27.35\", \"name\": \"https://github.com/zalando/skipper/releases/tag/v0.27.35\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-754\", \"description\": \"CWE-754: Improper Check for Unusual or Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T20:01:27.862Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-65838\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T13:55:41.273Z\", \"dateReserved\": \"2026-07-22T23:16:47.753Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-14T20:01:27.862Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-65838

Vulnerability from fkie_nvd - Published: 2026-09-14 20:16 - Updated: 2026-09-16 13:42

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
	security-advisories@github.com	https://github.com/zalando/skipper/releases/tag/v0.27.35
	security-advisories@github.com	https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "skipper",
          "vendor": "zalando",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.35"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35."
    }
  ],
  "id": "CVE-2026-65838",
  "lastModified": "2026-09-16T13:42:48.383",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-65838",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T13:26:56.403629Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T20:16:49.103",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8QQM-FP2Q-V734

Vulnerability from github – Published: 2026-07-17 21:49 – Updated: 2026-07-17 21:49

Summary

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Details

Summary

A wrong policy can be an open door. You have to check input.attributes.request.http.truncated_body in your policy.

Description

Incomplete fix for CVE-2026-50197: an oversized declared-Content-Length body still hands OPA an empty parsed_body, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.

The CVE-2026-50197 fix (commit 3152f3b0, PR #4041, v0.26.10) substituted expectedSize = maxBodyBytes only when req.ContentLength < 0 (chunked / HTTP/2 without content-length). But when a request declares a Content-Length larger than maxBodyBytes, expectedSize > maxBodyBytes, the body-extraction if is skipped entirely, and ExtractHttpBodyOptionally returns rawBodyBytes = nil — so OPA evaluates an empty parsed_body, while the full forbidden payload still flows to the upstream. A deny-on-presence policy (default allow = true; allow = false if input.parsed_body.<forbidden>) — the exact Rego shape the advisory describes — fails OPEN. The fix's own comment reasons only about ContentLength == -1; the oversized branch was never considered, and the added PoC test only covers small bodies.

Affected code

filters/openpolicyagent/openpolicyagent.go ExtractHttpBodyOptionally: the expectedSize <= maxBodyBytes gate lets an oversized declared body fall through to return req.Body, nil, func() {}, nil (OPA sees an empty document).
Corroborated by Skipper's own unit test "Read body exhausting max bytes" ({ "welcome": "world" }, maxBodySize: 5 → bodyInPolicy: "").

Steps to reproduce

See attached docker-compose.yml (official golang image) + setup.sh + exploit.sh, which run a real Skipper proxy (proxytest) with a real OPA control plane (opasdktest), WithMaxRequestBodyBytes(32), policy allow = false if input.parsed_body.action == "delete", route * -> opaAuthorizeRequestWithBody("test") -> upstream: - {"action":"delete"} (19B ≤ 32) → 403 (denied). - {"action":"delete","pad":"X..64"} (> 32) → 200, upstream received the full body (BYPASS). - small chunked {"action":"delete"} → 403 (positive control: the original CVE is fixed).

(Library-tier: validated via Skipper's real proxy test harness, not a deploy of the official image; benign oracle = status diff + upstream-received body; no RCE.)

Impact

Deployments authorizing on request-body content via opaAuthorizeRequestWithBody + deny-on-presence Rego can be bypassed by inflating the request body past -open-policy-agent-max-request-body-size (default 1 MB); the full payload still reaches the upstream.

Mitigation

Document how policy owners should block requests with oversized body.

Example deny by default and use "allow if" no oversized body:

default allow := false

allow if {
    input.attributes.request.http.truncated_body == false
    # ... body-based conditions
}

Example allow by default and use "deny if" an oversized body:

default deny := false

deny if {
    input.attributes.request.http.truncated_body == true
    # ... body-based conditions
}

Documentation is published by https://github.com/zalando/skipper/releases/tag/v0.27.26

Credit

Reported as part of an incomplete-patch measurement study (responsible disclosure).

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T21:49:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA wrong policy can be an open door. \nYou have to check `input.attributes.request.http.truncated_body` in your policy.\n\n### Description\n\nIncomplete fix for CVE-2026-50197: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.\n\nThe CVE-2026-50197 fix (commit `3152f3b0`, PR #4041, v0.26.10) substituted `expectedSize = maxBodyBytes`\nonly when `req.ContentLength \u003c 0` (chunked / HTTP/2 without content-length). But when a request declares a\n`Content-Length` larger than `maxBodyBytes`, `expectedSize \u003e maxBodyBytes`, the body-extraction `if` is\nskipped entirely, and `ExtractHttpBodyOptionally` returns `rawBodyBytes = nil` \u2014 so OPA evaluates an empty\n`parsed_body`, while the full forbidden payload still flows to the upstream. A deny-on-presence policy\n(`default allow = true; allow = false if input.parsed_body.\u003cforbidden\u003e`) \u2014 the exact Rego shape the\nadvisory describes \u2014 fails OPEN. The fix\u0027s own comment reasons only about `ContentLength == -1`; the\noversized branch was never considered, and the added PoC test only covers small bodies.\n\n### Affected code\n\n- `filters/openpolicyagent/openpolicyagent.go` `ExtractHttpBodyOptionally`: the\n  `expectedSize \u003c= maxBodyBytes` gate lets an oversized declared body fall through to\n  `return req.Body, nil, func() {}, nil` (OPA sees an empty document).\n- Corroborated by Skipper\u0027s own unit test \"Read body exhausting max bytes\" (`{ \"welcome\": \"world\" }`,\n  `maxBodySize: 5` \u2192 `bodyInPolicy: \"\"`).\n\n### Steps to reproduce\n\nSee attached `docker-compose.yml` (official `golang` image) + `setup.sh` + `exploit.sh`, which run a real\nSkipper proxy (`proxytest`) with a real OPA control plane (`opasdktest`),\n`WithMaxRequestBodyBytes(32)`, policy `allow = false if input.parsed_body.action == \"delete\"`, route\n`* -\u003e opaAuthorizeRequestWithBody(\"test\") -\u003e upstream`:\n- `{\"action\":\"delete\"}` (19B \u2264 32) \u2192 **403** (denied).\n- `{\"action\":\"delete\",\"pad\":\"X..64\"}` (\u003e 32) \u2192 **200**, upstream received the full body (BYPASS).\n- small chunked `{\"action\":\"delete\"}` \u2192 **403** (positive control: the original CVE is fixed).\n\n(Library-tier: validated via Skipper\u0027s real proxy test harness, not a deploy of the official image; benign\noracle = status diff + upstream-received body; no RCE.)\n\n### Impact\n\nDeployments authorizing on request-body content via `opaAuthorizeRequestWithBody` + deny-on-presence Rego\ncan be bypassed by inflating the request body past `-open-policy-agent-max-request-body-size` (default\n1 MB); the full payload still reaches the upstream.\n\n### Mitigation\n\nDocument how policy owners should block requests with oversized body.\n\nExample deny by default and use \"allow if\" no oversized body:\n```rego\ndefault allow := false\n\nallow if {\n    input.attributes.request.http.truncated_body == false\n    # ... body-based conditions\n}\n```\n\nExample allow by default and use \"deny if\" an oversized body:\n```rego\ndefault deny := false\n\ndeny if {\n    input.attributes.request.http.truncated_body == true\n    # ... body-based conditions\n}\n```\n\nDocumentation is published by https://github.com/zalando/skipper/releases/tag/v0.27.26\n\n### Credit\n\nReported as part of an incomplete-patch measurement study (responsible disclosure).",
  "id": "GHSA-8qqm-fp2q-v734",
  "modified": "2026-07-17T21:49:48Z",
  "published": "2026-07-17T21:49:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.27.26"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-65838 (GCVE-0-2026-65838)

FKIE_CVE-2026-65838

GHSA-8QQM-FP2Q-V734

Summary

Description

Affected code

Steps to reproduce

Impact

Mitigation

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour