CVE-2026-65838
Received Received - Intake

Content-Length Bypass in Skipper HTTP Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-65838

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_policy_agent skipper 0.27.35
zalando skipper 0.27.35

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Skipper's OPA filter allows an attacker to bypass request body checks by sending a request with an oversized Content-Length header. The filter incorrectly processes large requests, leaving OPA with an empty parsed body while forwarding the full body upstream. This defeats deny-on-presence policies that should block requests with forbidden payloads.

Detection Guidance

Detecting this vulnerability requires checking if your Skipper version is below 0.27.35 and if OPA policies rely on request body checks. Inspect Skipper logs for requests exceeding the max body size and verify policy logic for truncated_body handling.

Impact Analysis

If you use Skipper with OPA policies that check request bodies, an attacker could send malicious payloads that bypass your security controls. This could lead to unauthorized access, data exfiltration, or other attacks against your protected services. The vulnerability specifically affects deployments exceeding the default 1MB body size limit.

Compliance Impact

This vulnerability could undermine compliance efforts by allowing unauthorized data access or exfiltration through bypassed security controls. Organizations relying on request body inspection for policy enforcement may fail to meet requirements for data protection and access control mandated by GDPR, HIPAA, and similar regulations.

Mitigation Strategies

Upgrade Skipper to version 0.27.35 or later to address the issue. Review OPA policies to ensure they explicitly reject requests with truncated_body attributes to prevent bypassing deny-on-presence rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart