CVE-2026-65604
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.
| CWE | CWE-20 |
| Vendor | zalando |
| Product | skipper |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for zalando skipper
Be the first to know when new high vulnerabilities affecting zalando skipper are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
zalando / skipper
All versions affected References
Credits
🔍 sec-reex