Executive brief
Zalando Skipper, an HTTP router and reverse proxy, contains a flaw in how it handles security policies when integrated with Open Policy Agent (OPA). When a user sends a request with a data payload larger than the configured limit, the security engine fails to inspect the content but still allows the full request to reach the internal server. This allows attackers to bypass security rules designed to block specific actions or sensitive data transfers by simply inflating the size of their request.
Technical details
Skipper's OPA integration (specifically the opaAuthorizeRequestWithBody filter) fails to properly handle requests where the Content-Length header exceeds the 'maxBodyBytes' configuration. In the ExtractHttpBodyOptionally function, if the declared Content-Length is larger than the limit, the body extraction is skipped, and OPA is provided with an empty 'parsed_body'. Consequently, Rego policies using a 'deny-on-presence' logic (default allow) fail open. While the security engine sees no content to deny, the proxy still forwards the original, oversized, and potentially malicious payload to the upstream service. No code-level patch is currently available; the vendor has released documentation (v0.27.26) advising users to update their Rego policies to explicitly check the 'truncated_body' flag.
Affected products
- Zalando Skipper All versions up to and including v0.27.26 (no code fix available)
Timeline
- 2026-07-09: advisory: GHSA-8qqm-fp2q-v734 published by Zalando
- 2026-07-23: disclosed: CVE-2026-65604 published to NVD