Skipper vulnerabilities
3 known CVE vulnerabilities in Skipper, translated and rated.
- CVE-2022-27262Critical
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
- CVE-2026-65604High
Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence policies. When the request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates an empty parsed_body, allowing forbidden actions.
- CVE-2026-50197High
Vulnerability in Skipper (HTTP router and reverse proxy) before version 0.26.10 allows bypassing request body inspection for HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests without content-length header via OpenPolicyAgent integration. Attacker can send malicious data that is not inspected but reaches the upstream service.