Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-86043Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
High 7.5
In plain English
A high-severity incorrect authorization in skipper from zalando. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zalando/skipper | 0.27.37 | GHSA-5gpm-rgj3-9q76 |
| Go | github.com/zalando/skipper | 0.27.37 | GO-2026-6495 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76 x_refsource_CONFIRM
- https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507 x_refsource_MISC
- https://github.com/zalando/skipper/releases/tag/v0.27.35 x_refsource_MISC
- https://github.com/zalando/skipper/tree/v0.27.35 x_refsource_MISC