EUVD-2026-78059Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
AC:H reflects multiple required configuration preconditions; I:H captures authorization bypass allowing forbidden operations upstream; C:L acknowledges indirect disclosure risk.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.
AnalysisAI
Authorization bypass in Zalando Skipper's opaAuthorizeRequestWithBody filter allows unauthenticated remote attackers to deliver forbidden request bodies to upstream services by inflating the declared Content-Length beyond the configured OPA body-size limit. When a body exceeds -open-policy-agent-max-request-body-size (default 1 MB), ExtractHttpBodyOptionally skips body extraction and returns nil bytes to OPA, causing deny-on-presence Rego policies to evaluate an empty parsed_body and fail open, while the complete forbidden payload is still forwarded upstream unchanged. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following conditions simultaneously: (1) Skipper is deployed with the `opaAuthorizeRequestWithBody` filter (not `opaAuthorizeRequest`, which does not parse the body); (2) the associated OPA Rego policy uses deny-on-presence logic that inspects `input.parsed_body` fields (e.g., `allow = false if input.parsed_body.<field> == <value>`); (3) the Rego policy does NOT include a guard on `input.attributes.request.http.truncated_body` or `input.truncated_body`; and (4) the attacker can craft a request body that exceeds `-open-policy-agent-max-request-body-size` (default 1048576 bytes / 1 MB) by padding the payload while keeping the forbidden field present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:L) overstates the impact profile in two ways: complexity is genuinely high because exploitation requires the specific combination of `opaAuthorizeRequestWithBody` deployment, a deny-on-presence Rego policy that inspects `parsed_body`, a policy that does NOT check `truncated_body`, and a request body exceeding the size limit; and the primary impact is integrity (forbidden operations reaching the protected upstream), not confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Zalando Skipper to v0.27.35 or later, available at https://github.com/zalando/skipper/releases/tag/v0.27.35 and via the Go module path github.com/zalando/skipper. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Zalando Skipper deployments, audit which versions are running and whether opaAuthorizeRequestWithBody filters are in use, and immediately disable the vulnerable filter if you cannot patch immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). Rated critical severity (CVSS 9.8), this
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary
Skipper versions before 0.23.0 allow authenticated users with Ingress resource creation privileges to execute arbitrary
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. Rated high severity (CVS
Authorization bypass in Zalando Skipper (all versions through 0.27.25) lets remote unauthenticated attackers evade Open
Skipper versions up to 0.24.0 contains a vulnerability that allows attackers to list targets of an ExternalName and allo
Share
External POC / Exploit Code
Leaving vuln.today