Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the…
Historical advisory recorded 25 Oct 2026 15:18:45 UTC. Read the latest advisory.
nvd · CVE-2026-65838
PublishedSkipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2026-65838
PublishedNVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-754
Original publisher date fields
published: 2026-09-14T20:16:49.103
lastModified: 2026-09-16T13:42:48.383
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON