Is CVE-2026-65838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65838 being exploited in the wild.

How severe is CVE-2026-65838?

High severity, with a CVSS score of 8.2, published 14 September 2026.

Which products and versions are affected?

github.com/zalando/skipper (Go) SEMVER:introduced=0,fixed=0.27.26; Zalando Skipper prior to 0.27.35.

Is there a fix for CVE-2026-65838?

Yes. github.com/zalando/skipper (Go): upgrade to 0.27.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65838 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65838?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65838: Zalando Skipper OPA request body authorization bypass

CVE-2026-65838 · Severity: high · CVSS 8.2 · Published 2026-09-14

Skipper is an HTTP router and reverse proxy used by service platforms to control traffic flow and security. A flaw in its Open Policy Agent (OPA) authorization filter can allow attackers to bypass security policies by sending requests with artificially oversized Content-Length headers, causing the request body to be truncated during policy evaluation while still being forwarded in full to the backend service. This breaks authorization controls that inspect request bodies and allows forbidden payloads to reach protected services.

Technologies: github.com/zalando/skipper (Go), Zalando Skipper. Vendors: Go, Zalando.

Quick answers

Is CVE-2026-65838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65838 being exploited in the wild.
How severe is CVE-2026-65838?: High severity, with a CVSS score of 8.2, published 14 September 2026.
Which products and versions are affected?: github.com/zalando/skipper (Go) SEMVER:introduced=0,fixed=0.27.26; Zalando Skipper prior to 0.27.35.
Is there a fix for CVE-2026-65838?: Yes. github.com/zalando/skipper (Go): upgrade to 0.27.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65838 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65838?: Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zalando/skipper (Go): upgrade to 0.27.26 or later
```
go get github.com/zalando/skipper@v0.27.26
```

Technical details

The vulnerability exists in the opaAuthorizeRequestWithBody filter (filters/openpolicyagent/openpolicyagent.go) which implements request-body-aware authorization via Open Policy Agent. When a request exceeds the -open-policy-agent-max-request-body-size limit (default 1 MB), the ExtractHttpBodyOptionally function leaves OPA with an empty parsed_body while forwarding the complete request body upstream. Policy logic relying on input.attributes.request.http.truncated_body to reject oversized bodies can fail open if the policy does not explicitly reject this condition. This is an incomplete remediation of CVE-2026-50197. The vulnerability requires deployments to authorize request-body content and be configured to apply OPA policies; no authentication is required. Fixed in version 0.27.35.

Affected products

Zalando Skipper prior to 0.27.35

Identifiers

CVE-2026-65838
GHSA-8qqm-fp2q-v734
GO-2026-6019

Timeline

2026-09-14: disclosed
2026-07-20: patched: Version 0.27.35 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.