CyberRota Analysis
AI-GeneratedThe opaAuthorizeRequestWithBody filter in Skipper prior to version 0.27.35 is vulnerable to bypassing Rego policies due to mishandling oversized Content-Length requests, potentially allowing unauthorized payloads to reach protected services. This flaw primarily impacts deployments that rely on request-body content authorization and exceed the default maximum request body size of 1 MB. Organizations utilizing Skipper for HTTP routing and service composition should prioritize upgrading to version 0.27.35 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.