Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
- **Affected component:** `filters/openpolicyagent/openpolicyagent.go` → `ExtractHttpBodyOptionally`; combined with `github.com/open-policy-agent/opa-envoy-plugin` `envoyauth/request.go` → `getParsedBody` / `checkIfHTTPBodyTruncated`. Filter: `opaAuthorizeRequestWithBody`. - **Affected versions:** `<= 0.27.33` (current HEAD `e7d7014c`). The `truncated_body` mitigation was introduced/recommended in v0.27.26 (advisory GHSA-8qqm-fp2q-v734) and remains bypassable. - **Fix chain being audited:** CVE-2026-50197 (GHSA-659f-rgp5-w4wf, commit `3152f3b0`) → GHSA-8qqm-fp2q-v734 (docs + code, commit `1be950cd` #4126, v0.27.26). This finding is the third, still-open variant. ## Summary Skipper's `opaAuthorizeRequestWithBody` filter authorizes requests by handing the (bounded) request body to Open Policy Agent. When a body exceeds `-open-policy-agent-max-request-body-size` (default 1 MB), Skipper truncates it before OPA sees it. Advisory **GHSA-8qqm-fp2q-v734** established that deny-on-presence / body-inspecting policies fail OPEN on oversized bodies, and its remediation instructs policy authors to **guard on `input.attributes.request.http.truncated_body`** (implemented as the top-level `input.truncated_body`): ```rego default allow := false allow if { input.truncated_body == false # ... body-based conditions } ``` That mitigation is itself incomplete. The `truncated_body` flag is computed by the OPA envoy plugin **only when a `content-length` header is present**. A request sent with `Tran
GHSA-5gpm-rgj3-9q76
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-5gpm-rgj3-9q76
github.com/zalando/skipper
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.27.37
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.27.37"
}
]
}
],
"package": {
"name": "github.com/zalando/skipper",
"purl": "pkg:golang/github.com/zalando/skipper",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5gpm-rgj3-9q76/GHSA-5gpm-rgj3-9q76.json"
}
}
]- Related CVEs
- CVE-2026-86043
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #23418 · Revision 1
- Added to Heist Feed
- Publisher date