CVE-2026-65604

Name of the Vulnerable Software and Affected Versions Skipper (affected versions not specified)

Description An incomplete fix allows oversized request bodies to bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the maxBodyBytes limit, the system forwards the full payload to the upstream service while OPA evaluates an empty parsed body. Consequently, policies designed to deny requests based on body content are not enforced, allowing forbidden actions to proceed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.