The vulnerability in Zalando Skipper (CVE-2026-86043) arises because the opaAuthorizeRequestWithBody filter authorizes requests based on a truncated request body, but the Content-Length header does not reflect this truncation. Specifically, the input.truncated_body signal is derived from Content-Length rather than the actual read result. For HTTP/1.1 requests with Transfer-Encoding: chunked or HTTP/2 requests without Content-Length, a body-inspecting policy that relies on input.truncated_body being false may only evaluate the truncated prefix and allow the request, while the full oversized body is forwarded to the upstream service. This incorrect authorization is distinct from CVE-2026-50197 and is resolved in Skipper version 0.27.37.

An attacker can bypass authorization policies that inspect the request body by exploiting the mismatch between the truncated body used for policy evaluation and the actual full request body forwarded upstream. This can lead to unauthorized actions being performed on the protected upstream service. The vulnerability does not impact confidentiality or availability but has a high impact on integrity due to incorrect authorization.

Upgrade Zalando Skipper to version 0.27.37 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.