CVE-2026-65604 - Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Back Back to CVE browser

HIGH

Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Published Jul 23, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.39%

Description

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

Affected products

Vendor Zalando Product Skipper Default
affected

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zalando

Skipper

affected

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48437
Advisory
https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734
exploitvendor-advisory
https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48437		Advisory
https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734		exploitvendor-advisory
https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass		third-party-advisory