Executive brief
Skipper is an HTTP router and reverse proxy used to manage and direct web traffic between services. A security flaw in its integration with Open Policy Agent (OPA) allows attackers to bypass security rules that inspect the content of web requests. By using specific web communication methods (like chunked encoding or HTTP/2), an attacker can send malicious data that bypasses security checks entirely, potentially leading to unauthorized actions or data exposure in the backend systems Skipper is supposed to protect.
Technical details
A vulnerability exists in zalando/skipper's `opaAuthorizeRequestWithBody` filter due to inconsistent handling of HTTP requests lacking a `Content-Length` header. When a client uses `Transfer-Encoding: chunked` (HTTP/1.1) or HTTP/2 DATA frames without a length header, Go's `net/http` sets `ContentLength` to -1. The `ExtractHttpBodyOptionally` helper in `filters/openpolicyagent/openpolicyagent.go` incorrectly evaluates the loop condition `int64(m.bodyBuffer.Len()) < expectedSize` as false when `expectedSize` is -1. Consequently, OPA receives an empty body for inspection, causing Rego policies that deny requests based on body content to fail open. The full, uninspected attacker payload is then forwarded to the upstream service. This issue is fixed in version 0.26.10.
Affected products
- zalando skipper < 0.26.10
Timeline
- 2026-06-01: patched: Fix merged and version 0.26.10 released.
- 2026-07-17: advisory: CVE-2026-50197 published.