Which versions of Skipper are affected by CVE-2026-65604?

Zalando Skipper (all versions through 0.27.25), a critical API gateway for enforcing authorization policies, contains an authorization bypass flaw allowing unauthenticated attackers to evade Open…

How to fix or mitigate CVE-2026-65604?

Within 24 hours: Conduct an inventory of all Skipper deployments running versions 0.27.25 or earlier and immediately implement request size validation to reject oversized payloads. Within 7 days: Deploy WAF rules or reverse proxy configuration to enforce maxBodyBytes limits upstream of Skipper; audit and harden Open Policy Agent policies to use explicit deny-by-default rather than failing open. Within 30 days: Monitor Zalando Skipper releases closely for a code-level fix beyond v0.27.26; evaluate architectural alternatives or policy-enforcement mechanisms to reduce reliance on the affected authorization vector.

Skipper CVE-2026-65604

Q: What is the CVSS score of CVE-2026-65604?

CVE-2026-65604 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48437 HIGH

Improper Input Validation (CWE-20)

2026-07-23 VulnCheck

GHSA-p75f-h73c-3rcp

Authentication Bypass Skipper Zalando

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Unauthenticated remote body-padding trivially bypasses authorization (PR:N/AC:L), letting forbidden actions execute upstream (I:H); confidentiality only incidental (C:L) and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:03 vuln.today

Analysis Generated

Jul 23, 2026 - 22:03 vuln.today

CVE Published

Jul 23, 2026 - 21:16 cve.org

HIGH 8.8

DescriptionCVE.org

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

AnalysisAI

Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open Policy Agent body-content authorization by padding a request past the configured maxBodyBytes limit. Because Skipper forwards the oversized payload upstream while handing OPA an empty parsed_body, deny-on-presence Rego policies fail open and forbidden actions execute. This is an incomplete fix for CVE-2026-50197; publicly available exploit code exists (docker-compose PoC in the GHSA advisory), but there is no public evidence of active exploitation and no code-level fix - v0.27.26 only adds documentation.

Technical ContextAI

Skipper is Zalando's open-source HTTP router and reverse proxy, widely used as a Kubernetes ingress controller and API gateway, and it can delegate authorization to an embedded Open Policy Agent (OPA) engine via the opaAuthorizeRequestWithBody filter. That filter is supposed to parse the request body and expose it to Rego as input.parsed_body so policies can allow/deny based on content. The root cause is CWE-20 (improper input validation) in filters/openpolicyagent/openpolicyagent.go: the CVE-2026-50197 fix (commit 3152f3b0, PR #4041, v0.26.10) only substituted expectedSize = maxBodyBytes when req.ContentLength < 0 (chunked/HTTP2), but when a declared Content-Length exceeds maxBodyBytes, expectedSize > maxBodyBytes, the body-extraction branch is skipped, and ExtractHttpBodyOptionally returns rawBodyBytes = nil. OPA therefore evaluates an empty document while the full body still reaches upstream. CPE cpe:2.3:a:zalando:skipper:*:*:*:*:*:*:*:* covers the affected package go/github.com/zalando/skipper.

RemediationAI

No vendor-released code patch identified at time of analysis: v0.27.26 adds documentation guidance only and does not close the oversized-body branch, so upgrading alone does not fix the bypass. The actionable compensating control per the advisory is to harden your Rego so it fails closed on truncation - explicitly check input.attributes.request.http.truncated_body and deny (or treat as forbidden) whenever the body was truncated, rather than relying solely on input.parsed_body presence; side effect: legitimate oversized requests to body-authorized routes will now be rejected. Additionally, cap request body size at the ingress/proxy edge so bodies cannot exceed maxBodyBytes on authorized routes (trade-off: breaks legitimate large uploads on those paths), and audit every opaAuthorizeRequestWithBody route for deny-on-presence patterns. Track the vendor advisory GHSA-8qqm-fp2q-v734 (https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734) for a future code fix.