Executive brief
Zalando Skipper, an HTTP router and reverse proxy, contains a security flaw in how it handles large requests when using Open Policy Agent (OPA) for authorization. An attacker can bypass security policies by sending a request with a body larger than the configured limit, causing the proxy to skip security checks while still delivering the malicious payload to the internal application. This could allow unauthorized actions or data access that the security policy was intended to block.
Technical details
An incomplete fix for CVE-2026-50197 in Skipper's OPA filter leads to an authorization bypass. In 'filters/openpolicyagent/openpolicyagent.go', the 'ExtractHttpBodyOptionally' function fails to handle cases where the declared 'Content-Length' exceeds 'maxBodyBytes'. In such instances, the function returns a nil 'rawBodyBytes', causing OPA to evaluate an empty 'parsed_body' document. If a Rego policy is structured to deny requests based on the presence of specific fields in the body (deny-on-presence), the empty input results in an 'allow' decision while the full, potentially malicious payload is still forwarded to the upstream service. The vulnerability is mitigated in version 0.27.26 through updated documentation and policy recommendations to explicitly check the 'truncated_body' attribute.
Affected products
- zalando skipper < 0.27.26
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Mitigated via documentation update in v0.27.26
- 2026-07-17: advisory