CVE-2026-50197 Details
Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.
A vulnerability exists in Zalando Skipper's OpenPolicyAgent (OPA) integration, allowing request-body inspection to be bypassed on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header. This issue is present in Skipper versions prior to 0.26.10. The bypass occurs because the 'opaAuthorizeRequestWithBody' filter and the 'OpenPolicyAgentInstance.ExtractHttpBodyOptionally' method fail to process the request body correctly under these conditions. As a result, OPA policies that rely on body content evaluation may inadvertently allow requests that should be denied, while the upstream service receives the full, uninspected request body.
Users can update to Skipper version 0.26.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/zalando/skipper/commit/3152f3b0bb52ca89c3564be42434db0a2a1cea23 | [email protected] | Source CodeVendor |
| https://github.com/zalando/skipper/pull/4041 | [email protected] | Issue TrackingVendor |
| https://github.com/zalando/skipper/releases/tag/v0.26.10 | [email protected] | Release NotesVendor |
| https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zalando/skipper | <= 0.26.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |