CVE-2026-65604 zalando CVE debrief

Who should care

Defenders and security teams responsible for Skipper deployments, especially those using OPA deny-on-presence Rego policies, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-65604 is a high-severity vulnerability in Skipper that allows policy bypass, potentially leading to unauthorized actions. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where Skipper is used with OPA deny-on-presence Rego policies.

• Verify and update Skipper configurations to prevent policy bypass
• Monitor for suspicious request bodies that exceed configured limits
• Review and update OPA policies to ensure they are effective
• Assess exposure and prioritize remediation in Skipper deployments

Technical summary

The vulnerability occurs when a request body exceeds the configured maxBodyBytes limit in Skipper, causing the full payload to be forwarded to the upstream service while Open Policy Agent (OPA) evaluates against an empty parsed_body. This allows policies that deny requests based on body content to not be enforced, permitting forbidden actions to proceed. The issue arises from an incomplete fix for CVE-2026-50197, where Skipper fails to properly handle oversized request bodies, leading to potential policy bypass and unauthorized actions.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where Skipper is used with OPA deny-on-presence Rego policies.

Recommended defensive actions

• Verify Skipper deployment configurations and OPA policies to assess exposure
• Review and update maxBodyBytes limits to prevent policy bypass
• Monitor for suspicious request bodies that exceed configured limits
• Consider compensating controls, such as additional logging and monitoring
• Review Skipper and OPA policy documentation for additional guidance
• Assess exposure and prioritize remediation in Skipper deployments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected product. However, the corpus does not establish a fixed version, and the vendor advisory only adds documentation guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.