# CVE-2026-65838: Zalando Skipper OPA request body authorization bypass

Source: https://junglewise.ai/threats/cve-2026-65838-zalando-skipper-opa-request-body-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-65838 · Severity: high · CVSS 8.2 · Published 2026-09-14

Skipper is an HTTP router and reverse proxy used by service platforms to control traffic flow and security. A flaw in its Open Policy Agent (OPA) authorization filter can allow attackers to bypass security policies by sending requests with artificially oversized Content-Length headers, causing the request body to be truncated during policy evaluation while still being forwarded in full to the backend service. This breaks authorization controls that inspect request bodies and allows forbidden payloads to reach protected services.

Technologies: [github.com/zalando/skipper (Go)](https://junglewise.ai/threats/technologies/github-com-zalando-skipper), [Zalando Skipper](https://junglewise.ai/threats/technologies/skipper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Zalando](https://junglewise.ai/threats/vendors/zalando).

## Quick answers

**Is CVE-2026-65838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65838 being exploited in the wild.

**How severe is CVE-2026-65838?** High severity, with a CVSS score of 8.2, published 14 September 2026.

**Which products and versions are affected?** github.com/zalando/skipper (Go) SEMVER:introduced=0,fixed=0.27.26; Zalando Skipper prior to 0.27.35.

**Is there a fix for CVE-2026-65838?** Yes. github.com/zalando/skipper (Go): upgrade to 0.27.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65838 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65838?** Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zalando/skipper (Go): upgrade to 0.27.26 or later

  ```sh
  go get github.com/zalando/skipper@v0.27.26
  ```


## Technical details

The vulnerability exists in the opaAuthorizeRequestWithBody filter (filters/openpolicyagent/openpolicyagent.go) which implements request-body-aware authorization via Open Policy Agent. When a request exceeds the -open-policy-agent-max-request-body-size limit (default 1 MB), the ExtractHttpBodyOptionally function leaves OPA with an empty parsed_body while forwarding the complete request body upstream. Policy logic relying on input.attributes.request.http.truncated_body to reject oversized bodies can fail open if the policy does not explicitly reject this condition. This is an incomplete remediation of CVE-2026-50197. The vulnerability requires deployments to authorize request-body content and be configured to apply OPA policies; no authentication is required. Fixed in version 0.27.35.

## Affected products

- Zalando Skipper prior to 0.27.35

## Identifiers

- CVE-2026-65838
- GHSA-8qqm-fp2q-v734
- GO-2026-6019

## Timeline

- 2026-09-14: disclosed
- 2026-07-20: patched: Version 0.27.35 released

## References

- [https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507](https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507)
- [https://github.com/zalando/skipper/releases/tag/v0.27.35](https://github.com/zalando/skipper/releases/tag/v0.27.35)

## Related threats

- [Skipper OPA body-authz bypass in chunked/HTTP-2 requests](https://junglewise.ai/threats/cve-2026-86043-skipper-opa-body-authz-bypass-in-chunked-http-2-requests)
- [Zalando Skipper memory exhaustion DoS in admission webhook](https://junglewise.ai/threats/cve-2026-54247-zalando-skipper-memory-exhaustion-dos-in-admission-webhook)
- [Zalando Skipper missing authentication in routesrv API endpoints](https://junglewise.ai/threats/cve-2026-54246-zalando-skipper-missing-authentication-in-routesrv-api-endpoints)
- [Zalando Skipper OPA policy bypass via oversized request body](https://junglewise.ai/threats/cve-2026-65604-zalando-skipper-opa-policy-bypass-via-oversized-request-body)
- [Zalando Skipper OPA authorization bypass via HTTP request smuggling](https://junglewise.ai/threats/cve-2026-50197-zalando-skipper-opa-authorization-bypass-via-http-request)