The vulnerability in Skipper (prior to 0.27.35) involves improper checking of unusual conditions in the Open Policy Agent (OPA) authorization filter. Specifically, the opaAuthorizeRequestWithBody filter can be bypassed by sending a request with an oversized declared Content-Length, which causes ExtractHttpBodyOptionally to leave OPA with an empty parsed_body while forwarding the entire request body upstream. This incomplete remediation of a previous vulnerability (CVE-2026-50197) affects deployments that authorize request bodies larger than the configured -open-policy-agent-max-request-body-size (default 1 MB). If the Rego policy does not reject truncated_body attributes, it may fail open, allowing forbidden payloads to pass through. The vulnerability is resolved in Skipper version 0.27.35.

An attacker can bypass deny-on-presence Rego policies in Skipper's OPA authorization filter by exploiting the improper handling of oversized request bodies. This can result in forbidden payloads reaching protected backend services, potentially leading to unauthorized actions or data exposure. The vulnerability has a CVSS score of 8.2 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact.

This vulnerability is fixed in Skipper version 0.27.35. Users should upgrade to version 0.27.35 or later to remediate this issue. There is no indication that temporary workarounds or mitigations are available or recommended. Patch status is confirmed by the vendor advisory stating the fix is included in version 0.27.35.