CVE-2026-86043: Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncatedbody equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filters/openpolicyagent/OpenPolicyAgent (OPA) / opaAuthorizeRequestWithBody via Skipperadapterto a version that resolves this vulnerability.Fixed in 0.27.37
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Skipper versions before 0.27.37 are exposed if they use the opaAuthorizeRequestWithBody filter with a body-inspecting OPA policy that permits requests when input.truncated_body is false. The bypass applies to HTTP/1.1 requests sent with Transfer-Encoding: chunked and HTTP/2 requests that omit Content-Length.
What does an attacker need to do to exploit it?
An unauthenticated network attacker can send an oversized request body using chunked HTTP/1.1 or HTTP/2 without Content-Length. Skipper may present only a truncated prefix to OPA while forwarding the complete body to the protected upstream after authorization succeeds.
Are requests with a Content-Length header affected in the same way?
The described residual bypass specifically depends on requests for which Content-Length is absent: chunked HTTP/1.1 or HTTP/2 requests without Content-Length. The provided information does not identify the same behavior for requests that include Content-Length.
What version resolves the issue?
Upgrade Skipper to version 0.27.37. The issue affects versions prior to 0.27.37.