GO-2026-6019None▾ SunlitSkipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
github.com/zalando/skipper < 0.27.26Upgrade to a patched release:
github.com/zalando/skipper 0.27.26Connected by shared product, vendor, weakness, or advisory.
GHSA-8qqm-fp2q-v734High· 8.2Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
CVE-2026-65838High· 8.2Skipper is an HTTP router and reverse proxy for service composition
CVE-2026-50197High· 8.7Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests
CVE-2026-86043High· 7.5Skipper is an HTTP router and reverse proxy for service composition
CVE-2026-54246Medium· 5.7Skipper is an HTTP router and reverse proxy for service composition
CVE-2026-54247Medium· 4.3Skipper is an HTTP router and reverse proxy for service composition