CVE-2026-65604: Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsedbody, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until the incomplete fix for CVE-2026-50197 is resolved, mitigate the policy bypass by ensuring Skipper does not forward oversized request bodies to the upstream service when the request body exceeds the configured maxBodyBytes limit (so OPA policies that rely on body content are not evaluated against an empty parsed_body).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65604?
The severity of CVE-2026-65604 is high, rated at 8.2.
How do I fix CVE-2026-65604?
To fix CVE-2026-65604, ensure you apply the latest patches and updates provided for Skipper that address the policy bypass issues.
What impact does CVE-2026-65604 have on my application?
CVE-2026-65604 allows oversized request bodies to bypass Open Policy Agent evaluations, potentially exposing sensitive data.
Which software is affected by CVE-2026-65604?
CVE-2026-65604 affects the Skipper software.
What types of attacks can exploit CVE-2026-65604?
CVE-2026-65604 can be exploited through denial of service or unauthorized access due to policy bypasses.