What’s Vulnerable › Vulnerabilities

CVE-2026-50197: Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

• Severity: high (CVSS 7.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-17 · updated 2026-10-24
• Weakness: CWE-444

Description

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.

Affected products

• zalando skipper: before 0.26.10

References

• https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23
• https://github.com/zalando/skipper/pull/4041
• https://github.com/zalando/skipper/releases/tag/v0.26.10
• https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf
• https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf

Get alerted when CVE-2026-50197 or the next vulnerability affects your stack