Executive brief
Skipper is an HTTP router and reverse proxy used by service platforms to control traffic flow and security. A flaw in its Open Policy Agent (OPA) authorization filter can allow attackers to bypass security policies by sending requests with artificially oversized Content-Length headers, causing the request body to be truncated during policy evaluation while still being forwarded in full to the backend service. This breaks authorization controls that inspect request bodies and allows forbidden payloads to reach protected services.
Technical details
The vulnerability exists in the opaAuthorizeRequestWithBody filter (filters/openpolicyagent/openpolicyagent.go) which implements request-body-aware authorization via Open Policy Agent. When a request exceeds the -open-policy-agent-max-request-body-size limit (default 1 MB), the ExtractHttpBodyOptionally function leaves OPA with an empty parsed_body while forwarding the complete request body upstream. Policy logic relying on input.attributes.request.http.truncated_body to reject oversized bodies can fail open if the policy does not explicitly reject this condition. This is an incomplete remediation of CVE-2026-50197. The vulnerability requires deployments to authorize request-body content and be configured to apply OPA policies; no authentication is required. Fixed in version 0.27.35.
Affected products
- Zalando Skipper prior to 0.27.35
Timeline
- 2026-09-14: disclosed
- 2026-07-20: patched: Version 0.27.35 released