CVE-2026-65604

Received Received - Intake

Incomplete OPA Policy Bypass via Oversized Request Body in Skipper

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-65604

Affected Vendors & Products

Vendor	Product	Version / Range
skipper	skipper	to 0.27.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body. This allows policies that deny requests based on body content to be bypassed, letting forbidden actions proceed.

Impact Analysis

This vulnerability allows unauthorized or malicious requests to bypass security policies enforced by OPA. Attackers could exploit this to send oversized payloads that trigger forbidden actions, potentially leading to data breaches, unauthorized access, or other security incidents.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, and other regulations by allowing unauthorized data access or processing. Security policies designed to protect sensitive data may be bypassed, increasing the risk of non-compliance with data protection requirements.

Mitigation Strategies

Monitor request body sizes to ensure they do not exceed maxBodyBytes limits. Review OPA policies to confirm they account for potential bypass scenarios. Consider implementing additional validation layers beyond OPA for critical requests.

Hi! I’m here to help you understand CVE-2026-65604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70