CVE-2026-50197

Name of the Vulnerable Software and Affected Versions zalando/skipper versions prior to 0.26.10

Description The OpenPolicyAgent integration in zalando/skipper contains a flaw that allows request-body inspection to be bypassed. This occurs during HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header. In these cases, the opaAuthorizeRequestWithBody filter and the OpenPolicyAgentInstance.ExtractHttpBodyOptionally() function produce an empty raw body and input.parsed body. Consequently, Rego policies that rely on body content to deny requests evaluate against an empty document and may authorize the request, while the upstream service still receives the full attacker-controlled body.

Recommendations Update zalando/skipper to version 0.26.10 or later. As a temporary workaround, restrict the use of the opaAuthorizeRequestWithBody filter for critical security checks until the update is applied.