Is CVE-2026-86043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86043 being exploited in the wild.

How severe is CVE-2026-86043?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

github.com/zalando/skipper (Go) < 0.27.37, SEMVER:introduced=0,fixed=0.27.37; Zalando Skipper <= 0.27.33.

Is there a fix for CVE-2026-86043?

Yes. github.com/zalando/skipper (Go): upgrade to 0.27.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86043 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86043?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86043: Skipper OPA body-authz bypass in chunked/HTTP-2 requests

Q: Is there a fix for CVE-2026-86043?

Yes. github.com/zalando/skipper (Go): upgrade to 0.27.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-86043 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-86043?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86043 · Severity: high · CVSS 7.5 · Published 2026-09-16

Skipper is an HTTP reverse proxy that uses Open Policy Agent (OPA) to authorize requests based on their body content. The previous mitigation against oversized request bodies relies on an OPA field called `truncated_body`, which informs policies whether the request body was truncated during inspection. However, this flag is only set when a Content-Length header is present. Requests sent with chunked transfer encoding or over HTTP/2 (which lack Content-Length) are incorrectly marked as not truncated, allowing large payloads to bypass authorization checks and reach the protected upstream service in full.

Technologies: github.com/zalando/skipper (Go), Zalando Skipper. Vendors: Go, Zalando.

Quick answers

Is CVE-2026-86043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86043 being exploited in the wild.
How severe is CVE-2026-86043?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: github.com/zalando/skipper (Go) < 0.27.37, SEMVER:introduced=0,fixed=0.27.37; Zalando Skipper <= 0.27.33.
Is there a fix for CVE-2026-86043?: Yes. github.com/zalando/skipper (Go): upgrade to 0.27.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86043 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86043?: Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zalando/skipper (Go): upgrade to 0.27.37 or later
```
go get github.com/zalando/skipper@v0.27.37
```

Technical details

This vulnerability is an incomplete fix of GHSA-8qqm-fp2q-v734. The root cause lies in how the OPA Envoy plugin (`opa-envoy-plugin`) computes the `truncated_body` flag in `envoyauth/request.go`. The function `getParsedBody()` only checks for body truncation when a `content-length` header is present; for chunked transfer encoding or HTTP/2 requests that lack this header, it returns `truncated_body = false` by default. Meanwhile, Skipper's `ExtractHttpBodyOptionally()` *does* truncate the body when it exceeds `max-request-body-size`. An attacker can send an oversized request body using `Transfer-Encoding: chunked` (HTTP/1.1) or over HTTP/2, which will be truncated by Skipper but reported to OPA as not truncated. A policy following the advisory's mitigation (`allow if input.truncated_body == false`) will incorrectly authorize the request, and Skipper will forward the full, uninspected payload to the upstream. No authentication or special conditions are required; a single crafted request suffices.

Affected products

Zalando Skipper <= 0.27.33

Identifiers

CVE-2026-86043
GHSA-5gpm-rgj3-9q76
GO-2026-6495

Timeline

2026-09-17: disclosed: GHSA-5gpm-rgj3-9q76 advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.