CVE-2026-50197
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Vulnerability in Skipper (HTTP router and reverse proxy) before version 0.26.10 allows bypassing request body inspection for HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests without content-length header via OpenPolicyAgent integration. Attacker can send malicious data that is not inspected but reaches the upstream service.
Risk Assessment
Attack can lead to security policy bypass, allowing unauthorized data to be sent to internal services, potentially leading to privilege escalation or data leakage.
Recommendation
Upgrade Skipper to version 0.26.10 or later immediately.
Other vulnerabilities in Skipper
See all- CVE-2022-27262Critical
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
- CVE-2026-65604High
Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence policies. When the request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates an empty parsed_body, allowing forbidden actions.
Original NVD description (English source)
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.