EUVD-2026-81002Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated request with attacker-controlled transfer encoding (AV:N/AC:L/PR:N/UI:N); bypasses a body-authorization control so I:H, with no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
AnalysisAI
Authorization bypass in Zalando Skipper before 0.27.37 lets unauthenticated remote attackers slip an oversized request body past an Open Policy Agent body-inspection policy: when the opaAuthorizeRequestWithBody filter truncates the body at maxBodyBytes, Skipper derives the input.truncated_body signal from Content-Length rather than the bytes actually read, so an HTTP/1.1 chunked or Content-Length-less HTTP/2 request is evaluated by OPA as non-truncated, allowed, and then forwarded in full to the protected upstream (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, CWE-863). Exploitation is gated on a non-default deployment: the filter must be active and the policy must explicitly allow requests when input.truncated_body == false, the pattern recommended as the prior mitigation for CVE-2026-50197, while installations that do not inspect bodies or do not key on truncated_body are unaffected and requests carrying an accurate Content-Length are correctly flagged as truncated and denied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires Skipper deployed with the opaAuthorizeRequestWithBody filter and an Open Policy Agent policy that inspects the request body AND explicitly allows requests when input.truncated_body == false (the recommended prior mitigation for CVE-2026-50197). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine unauthenticated remote authorization bypass (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, CWE-863), but its real-world risk is materially narrower than the 7.5 base score implies because exploitation is heavily gated on a specific, non-default deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Skipper 0.27.37, the release that contains the vendor fix (Vendor-released patch: 0.27.37); the upstream code change is commit 2cfceabaa6ff0af65b312dcb9bcbe84691b9d507, which introduces the x-envoy-auth-partial-body header so policies can trust the truncation signal, and the advisory is at https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Zalando Skipper deployments and determine whether any run versions before 0.27.37 with the opaAuthorizeRequestWithBody filter active and an OPA policy that allows requests when input.truncated_body == false; if found, immediately disable the body-inspection filter, change the policy to deny when truncated_body is false or absent, or block chunked and Content-Length-less requests at the edge. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today