CVE-2026-65604 is a high-severity vulnerability in Skipper, a project from Zalando, that allows policy bypass due to an incomplete fix for CVE-2026-50197. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while Open Policy Agent (OPA) evaluates against an empty parsed_body. This causes policies that deny requests based on body content [truncated]
CVE-2026-50197 is a vulnerability in Skipper, an HTTP router and reverse proxy for service composition. The vulnerability allows an attacker to send a full, attacker-controlled body to the upstream service due to the OpenPolicyAgent integration silently bypassing request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header. This issue is fix [truncated]
