CVE-2026-86043

Skipper, an HTTP router and reverse proxy for service composition, contains an authorization flaw in its opaAuthorizeRequestWithBody filter: when a request body exceeds maxBodyBytes it is truncated before being sent to Open Policy Agent, but the input.truncated_body signal passed to OPA is derived from Content-Length rather than the actual bytes read. An attacker can trigger this by sending an HTTP/1.1 request with Transfer-Encoding: chunked or an HTTP/2 request without a Content-Length header, since skipperadapter.go copies the request headers without updating Content-Length to reflect the truncation. A body-inspecting OPA policy that follows the prior CVE-2026-50197 mitigation and permits requests with truncated_body equal to false will evaluate only the truncated prefix, allow the request, and Skipper then forwards the full oversized body to the protected upstream. An attacker gains a bypass of body-content-based authorization, letting unvetted oversized payloads reach backend services (integrity impact, no confidentiality or availability loss per the CVSS score). Any Skipper deployment before 0.27.37 using the OPA authorization filter with body truncation is affected; no public proof-of-concept or known exploitation exists, and the flaw is fixed in version 0.27.37.

What to do: Upgrade to Skipper 0.27.37 or later, which fixes the truncated_body signal handling. As an interim mitigation, update OPA policies to deny requests using Transfer-Encoding: chunked or lacking Content-Length when the opaAuthorizeRequestWithBody filter inspects bodies, or enforce a hard body-size limit so oversized requests are rejected rather than truncated. Operators who relied on the CVE-2026-50197 mitigation (permitting only truncated_body == false) should audit those policies for requests without Content-Length.