Skipper OPA body checks fail open on chunked requests

A GitHub security advisory published on 17 September 2026 says the recommended fix for an earlier flaw in Zalando's Skipper HTTP router does not work, leaving request-body authorisation bypassable in affected deployments. The advisory, tracked as GHSA-5gpm-rgj3-9q76 and CVE-2026-86043, covers Skipper versions up to and including 0.27.33. It is scored 7.5, High, using CVSS 3.1.

The problem sits in Skipper's opaAuthorizeRequestWithBody filter, which passes a request body to Open Policy Agent (OPA) so a policy can decide whether to allow the request. Skipper only buffers a bounded amount of the body, one megabyte by default. Anything larger is truncated before OPA sees it. An earlier advisory, GHSA-8qqm-fp2q-v734, established that body-inspecting policies fail open on oversized bodies, and told policy authors to guard their rules on a truncated_body flag so that truncated requests are denied.

According to the new advisory, that guard does not fire. The truncated_body flag is calculated by the OPA Envoy plugin only when a content-length header is present, by comparing the declared length against the number of bytes actually received. A request sent with Transfer-Encoding: chunked over HTTP/1.1, or any request over HTTP/2, carries no content-length. The comparison is skipped and the flag stays false, even though Skipper has truncated the body. The policy sees a request it believes was fully inspected and allows it.

The advisory says the consequences are worse than a simple missed check. Skipper's buffered body reader serves the truncated prefix it inspected and then keeps draining the original request body, so the full, un-inspected oversized payload is forwarded to the upstream service. Anything the policy was meant to reject, including forbidden content sitting beyond the inspection window, reaches the protected backend.

Affected deployments are those running the body-inspecting filter with a policy that follows the official mitigation, which the advisory notes is the maintainer-recommended configuration documented in version 0.27.26. Exploitation requires no authentication, no user interaction and no special timing. The advisory describes it as a single crafted request using chunked framing plus padding.

This is the third variant in the same chain. The advisory traces it back to CVE-2026-50197 and its fix, then to GHSA-8qqm-fp2q-v734, which added documentation and code changes in version 0.27.26. It points out that the transport class defeating the mitigation, chunked or HTTP/2 traffic without a content-length header, is the same transport class the original CVE was about. The earlier fix closed the variant where a content-length header was declared, and its test only exercised small chunked bodies, never oversized ones.

The advisory lists the issue as still open at commit e7d7014c, described as current HEAD. It gives the affected Go package as github.com/zalando/skipper, with the relevant code in filters/openpolicyagent/openpolicyagent.go and in the envoyauth/request.go file of the opa-envoy-plugin dependency. The record notes that the only guard on the path is the truncated_body flag, and that it is defeated simply by omitting a header. No fixed version is named in the advisory.