Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65604Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

High 8.2

In plain English

A high-severity improper input validation in skipper from zalando. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 66.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

Affected products (as reported)

Vendor	Product	Versions
zalando	skipper	see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-8qqm-fp2q-v734) vendor-advisory
VulnCheck Advisory: Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass third-party-advisory