GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

CVE-2026-86043

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:24+00:00| published-proof-of-concept| https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76...

GHSA-5GPM-RGJ3-9Q76 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

EUVD-2026-81002

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go and AdaptToExtAuthRequest in filters/openpolicyagent/internal/envoy/skipperadapter.go. An attacker can get an oversized request body...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go and AdaptToExtAuthRequest in filters/openpolicyagent/internal/envoy/skipperadapter.go. An attacker can get an oversized request body...

CVE-2026-86043

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043

Skipper (an HTTP router and reverse proxy) has a vulnerability in the opaAuthorizeRequestWithBody filter prior to version 0.27.37 . The truncated_body signal is derived from the Content-Length header rather than the actual read result. When a body is truncated at maxBodyBytes, the header is not u...

CVE-2026-86043

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043: Incorrect Authorization

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

PT-2026-93918

Name of the Vulnerable Software and Affected Versions Skipper versions prior to 0.27.37 Description Skipper is an HTTP router and reverse proxy for service composition. The opaAuthorizeRequestWithBody filter can authorize oversized requests by incorrectly signaling the truncation state to the Ope...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded request body reads in the Kubernetes admission webhook handler in dataclients/kubernetes/admission/admission.go. An attacker can exhaust memory and OOM-kill the skipp...

CVE-2026-65838

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-54247

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...

CVE-2026-54246

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

EUVD-2026-78062

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...