CVE-2026-50197: Zalando Skipper OPA authorization bypass via HTTP request smuggling

CVE-2026-50197 · Severity: high · CVSS 8.7 · Published 2026-07-17

Skipper is an HTTP router and reverse proxy used to manage and direct web traffic between services. A security flaw in its integration with Open Policy Agent (OPA) allows attackers to bypass security rules that inspect the content of web requests. By using specific web communication methods (like chunked encoding or HTTP/2), an attacker can send malicious data that bypasses security checks entirely, potentially leading to unauthorized actions or data exposure in the backend systems Skipper is supposed to protect.

Technologies: github.com/zalando/skipper (Go), Zalando Skipper. Vendors: Go, Zalando.

Quick answers

Is CVE-2026-50197 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50197 being exploited in the wild.
How severe is CVE-2026-50197?
High severity, with a CVSS score of 8.7, published 17 July 2026.
Which products and versions are affected?
github.com/zalando/skipper (Go) < 0.26.10, SEMVER:introduced=0,fixed=0.26.10; Zalando Skipper < 0.26.10, <= v0.26.8.
Is there a fix for CVE-2026-50197?
Yes. github.com/zalando/skipper (Go): upgrade to 0.26.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50197 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50197?
Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zalando/skipper (Go): upgrade to 0.26.10 or later
    go get github.com/zalando/skipper@v0.26.10

Technical details

A vulnerability exists in zalando/skipper's `opaAuthorizeRequestWithBody` filter due to inconsistent handling of HTTP requests lacking a `Content-Length` header. When a client uses `Transfer-Encoding: chunked` (HTTP/1.1) or HTTP/2 DATA frames without a length header, Go's `net/http` sets `ContentLength` to -1. The `ExtractHttpBodyOptionally` helper in `filters/openpolicyagent/openpolicyagent.go` incorrectly evaluates the loop condition `int64(m.bodyBuffer.Len()) < expectedSize` as false when `expectedSize` is -1. Consequently, OPA receives an empty body for inspection, causing Rego policies that deny requests based on body content to fail open. The full, uninspected attacker payload is then forwarded to the upstream service. This issue is fixed in version 0.26.10.

Affected products

  • zalando skipper < 0.26.10

Identifiers

  • CVE-2026-50197
  • GHSA-659f-rgp5-w4wf
  • GO-2026-5944

Timeline

  • 2026-06-01: patched: Fix merged and version 0.26.10 released.
  • 2026-07-17: advisory: CVE-2026-50197 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.