CVE-2026-65604
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence policies. When the request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates an empty parsed_body, allowing forbidden actions.
Risk Assessment
An attacker can send malicious requests with large bodies that bypass OPA security policies, potentially leading to unauthorized operations or data breaches.
Recommendation
No fixed version is available; apply documentation guidance from v0.27.26 and consider additional safeguards such as limiting request body size at the proxy level.
Other vulnerabilities in Skipper
See all- CVE-2022-27262Critical
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
- CVE-2026-50197High
Vulnerability in Skipper (HTTP router and reverse proxy) before version 0.26.10 allows bypassing request body inspection for HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests without content-length header via OpenPolicyAgent integration. Attacker can send malicious data that is not inspected but reaches the upstream service.
Original NVD description (English source)
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.