Request body extraction bypass in Zalando Skipper OPA authorization filter (CVE-2026-50197)

In github.com/zalando/skipper, the `opaAuthorizeRequestWithBody` filter fails to read the request body for HTTP/1.1 `Transfer-Encoding: chunked` requests and HTTP/2 requests lacking a `content-length` pseudo-header. The `ExtractHttpBodyOptionally` helper returns an empty `raw_body` to OPA for these requests, causing Rego policies that gate on `input.parsed_body` to evaluate against an empty document and fail open, while the full unexamined request body is forwarded to the upstream service. Public POC available. Affected versions: - <= 0.26.9 We recommend updating to: >= v0.26.10. CVSS 7.8 · our assessment: this_week Vendor advisory: https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf Details: https://vuln.today/cve/CVE-2026-50197