CVE-2026-65838

Zalando Skipper, an HTTP router and reverse proxy commonly used as a Kubernetes ingress, incompletely enforces Open Policy Agent (OPA) authorization when a request's declared Content-Length exceeds -open-policy-agent-max-request-body-size, which defaults to 1 MB. In versions prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go passes OPA an empty parsed_body (via ExtractHttpBodyOptionally) while still forwarding the complete request body upstream, so a deny-on-payload-content Rego policy never sees the offending content and fails open. An unauthenticated remote attacker can abuse this to smuggle a forbidden payload past body-content policy checks to the protected backend service (CVSS 8.2, high confidentiality impact). Only deployments that authorize request bodies with the openpolicyagent filters and can exceed the body-size limit are affected — small bodies and the previously fixed chunked-body case from CVE-2026-50197 are evaluated normally. The flaw is fixed in version 0.27.35; no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade Skipper to version 0.27.35 or later. As defense-in-depth, update Rego policies to explicitly deny requests where input.attributes.request.http.truncated_body is true, and audit logs for oversized-body requests that were authorized since the earlier CVE-2026-50197 fix. Verify whether any routes rely on opaAuthorizeRequestWithBody or other openpolicyagent filters that inspect request bodies.