CVE-2026-50197 describes an HTTP request smuggling vulnerability (CWE-444) in zalando/skipper's OpenPolicyAgent integration prior to version 0.26.10. The vulnerability arises because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally function produce empty raw_body and parsed_body for HTTP/1.1 Transfer-Encoding: chunked requests and HTTP/2 requests that omit the content-length pseudo-header. Consequently, the policy enforcement component bypasses request-body inspection while the upstream service processes the full attacker-controlled body, leading to inconsistent interpretation of HTTP requests and potential security bypass.

This vulnerability allows an attacker to bypass request-body inspection by the OpenPolicyAgent filter, potentially evading security policies enforced by the proxy. The upstream service still receives the full malicious payload, which may lead to unauthorized actions or data exposure depending on the deployed policies and backend services. The CVSS 4.0 score is 7.8 (high severity), indicating a significant risk if exploited.

Upgrade zalando/skipper to version 0.26.10 or later, where this issue is fixed. No other mitigation is indicated or required as the fix addresses the root cause of the inconsistent request-body handling.