Is CVE-2026-65604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65604 being exploited in the wild.

How severe is CVE-2026-65604?

High severity, with a CVSS score of 8.2, published 23 July 2026.

Which products and versions are affected?

Zalando Skipper All versions up to and including v0.27.26 (no code fix available).

Is there a fix for CVE-2026-65604?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65604 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65604?

Check whether you run Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65604: Zalando Skipper OPA policy bypass via oversized request body

CVE-2026-65604 · Severity: high · CVSS 8.2 · Published 2026-07-23

Zalando Skipper, an HTTP router and reverse proxy, contains a flaw in how it handles security policies when integrated with Open Policy Agent (OPA). When a user sends a request with a data payload larger than the configured limit, the security engine fails to inspect the content but still allows the full request to reach the internal server. This allows attackers to bypass security rules designed to block specific actions or sensitive data transfers by simply inflating the size of their request.

Technologies: Zalando Skipper. Vendors: Zalando.

Quick answers

Is CVE-2026-65604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65604 being exploited in the wild.
How severe is CVE-2026-65604?: High severity, with a CVSS score of 8.2, published 23 July 2026.
Which products and versions are affected?: Zalando Skipper All versions up to and including v0.27.26 (no code fix available).
Is there a fix for CVE-2026-65604?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65604 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65604?: Check whether you run Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Skipper's OPA integration (specifically the opaAuthorizeRequestWithBody filter) fails to properly handle requests where the Content-Length header exceeds the 'maxBodyBytes' configuration. In the ExtractHttpBodyOptionally function, if the declared Content-Length is larger than the limit, the body extraction is skipped, and OPA is provided with an empty 'parsed_body'. Consequently, Rego policies using a 'deny-on-presence' logic (default allow) fail open. While the security engine sees no content to deny, the proxy still forwards the original, oversized, and potentially malicious payload to the upstream service. No code-level patch is currently available; the vendor has released documentation (v0.27.26) advising users to update their Rego policies to explicitly check the 'truncated_body' flag.

Affected products

Zalando Skipper All versions up to and including v0.27.26 (no code fix available)

Timeline

2026-07-09: advisory: GHSA-8qqm-fp2q-v734 published by Zalando
2026-07-23: disclosed: CVE-2026-65604 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.