---
id: CVE-2026-86043
title: Skipper is an HTTP router and reverse proxy for service composition
summary: >-
  Skipper is an HTTP router and reverse proxy for service composition. Prior to
  version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an
  oversized request after Skipper truncates the body presented to Open Policy
  Agent beca…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-863
vendor: zalando
product: skipper
affected:
  - skipper < 0.27.37
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:17:36.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86043'
references:
  - url: >-
      https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
    label: security-advisories@github.com
  - url: 'https://github.com/zalando/skipper/releases/tag/v0.27.35'
    label: security-advisories@github.com
  - url: 'https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76'
    label: security-advisories@github.com
  - url: 'https://github.com/zalando/skipper/tree/v0.27.35'
    label: security-advisories@github.com
  - url: 'https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86043'
  - url: 'https://github.com/zalando/skipper/releases/tag/v0.27.37'
  - url: 'https://github.com/advisories/GHSA-5gpm-rgj3-9q76'
  - url: 'https://github.com/zalando/skipper'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - go
  - osv
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T19:38:03.907390Z'
ingestedAt: '2026-09-16T19:02:30.723Z'
aliases:
  - GHSA-5gpm-rgj3-9q76
ecosystem: go
patched:
  - github.com/zalando/skipper 0.27.37
epss: 0.00451
epssPercentile: 0.36558
---

## Overview

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-86043)

Affected packages:

- `github.com/zalando/skipper < 0.27.37`

Patched in:

- `github.com/zalando/skipper 0.27.37`

Source: https://github.com/advisories/GHSA-5gpm-rgj3-9q76