# CVE-2026-86043: Skipper OPA body-authz bypass in chunked/HTTP-2 requests

Source: https://junglewise.ai/threats/cve-2026-86043-skipper-opa-body-authz-bypass-in-chunked-http-2-requests  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-86043 · Severity: high · CVSS 7.5 · Published 2026-09-16

Skipper is an HTTP reverse proxy that uses Open Policy Agent (OPA) to authorize requests based on their body content. The previous mitigation against oversized request bodies relies on an OPA field called `truncated_body`, which informs policies whether the request body was truncated during inspection. However, this flag is only set when a Content-Length header is present. Requests sent with chunked transfer encoding or over HTTP/2 (which lack Content-Length) are incorrectly marked as not truncated, allowing large payloads to bypass authorization checks and reach the protected upstream service in full.

Technologies: [github.com/zalando/skipper (Go)](https://junglewise.ai/threats/technologies/github-com-zalando-skipper), [Zalando Skipper](https://junglewise.ai/threats/technologies/skipper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Zalando](https://junglewise.ai/threats/vendors/zalando).

## Quick answers

**Is CVE-2026-86043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86043 being exploited in the wild.

**How severe is CVE-2026-86043?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** github.com/zalando/skipper (Go) < 0.27.37, SEMVER:introduced=0,fixed=0.27.37; Zalando Skipper <= 0.27.33.

**Is there a fix for CVE-2026-86043?** Yes. github.com/zalando/skipper (Go): upgrade to 0.27.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86043 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86043?** Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zalando/skipper (Go): upgrade to 0.27.37 or later

  ```sh
  go get github.com/zalando/skipper@v0.27.37
  ```


## Technical details

This vulnerability is an incomplete fix of GHSA-8qqm-fp2q-v734. The root cause lies in how the OPA Envoy plugin (`opa-envoy-plugin`) computes the `truncated_body` flag in `envoyauth/request.go`. The function `getParsedBody()` only checks for body truncation when a `content-length` header is present; for chunked transfer encoding or HTTP/2 requests that lack this header, it returns `truncated_body = false` by default. Meanwhile, Skipper's `ExtractHttpBodyOptionally()` *does* truncate the body when it exceeds `max-request-body-size`. An attacker can send an oversized request body using `Transfer-Encoding: chunked` (HTTP/1.1) or over HTTP/2, which will be truncated by Skipper but reported to OPA as not truncated. A policy following the advisory's mitigation (`allow if input.truncated_body == false`) will incorrectly authorize the request, and Skipper will forward the full, uninspected payload to the upstream. No authentication or special conditions are required; a single crafted request suffices.

## Affected products

- Zalando Skipper <= 0.27.33

## Identifiers

- CVE-2026-86043
- GHSA-5gpm-rgj3-9q76
- GO-2026-6495

## Timeline

- 2026-09-17: disclosed: GHSA-5gpm-rgj3-9q76 advisory published

## Related threats

- [Zalando Skipper OPA request body authorization bypass](https://junglewise.ai/threats/cve-2026-65838-zalando-skipper-opa-request-body-authorization-bypass)
- [Zalando Skipper memory exhaustion DoS in admission webhook](https://junglewise.ai/threats/cve-2026-54247-zalando-skipper-memory-exhaustion-dos-in-admission-webhook)
- [Zalando Skipper missing authentication in routesrv API endpoints](https://junglewise.ai/threats/cve-2026-54246-zalando-skipper-missing-authentication-in-routesrv-api-endpoints)
- [Zalando Skipper OPA policy bypass via oversized request body](https://junglewise.ai/threats/cve-2026-65604-zalando-skipper-opa-policy-bypass-via-oversized-request-body)
- [Zalando Skipper OPA authorization bypass via HTTP request smuggling](https://junglewise.ai/threats/cve-2026-50197-zalando-skipper-opa-authorization-bypass-via-http-request)