CVE-2026-65838

Name of the Vulnerable Software and Affected Versions Skipper versions prior to 0.27.35

Description An issue exists in the opaAuthorizeRequestWithBody filter within filters/openpolicyagent/openpolicyagent.go where requests with a declared Content-Length exceeding the -open-policy-agent-max-request-body-size (defaulting to 1 MB) can bypass deny-on-presence Rego policies. This occurs because the ExtractHttpBodyOptionally() function provides an empty parsed body to the Open Policy Agent (OPA) while still forwarding the full request body to the upstream service. Consequently, policy logic that does not explicitly reject the input.attributes.request.http.truncated body variable may fail open, allowing forbidden payloads to reach the protected service.

Recommendations Update Skipper to version 0.27.35. As a mitigation measure, policy owners should modify Rego policies to block requests with oversized bodies by checking the input.attributes.request.http.truncated body variable.