This vulnerability is an incomplete fix for CVE-2026-50197 in the Skipper proxy's integration with Open Policy Agent (OPA). The original fix addressed chunked or HTTP/2 requests without a Content-Length header but did not handle requests with an oversized declared Content-Length properly. When the declared Content-Length exceeds the max allowed body size, the body extraction logic skips reading the body, resulting in OPA receiving an empty parsed_body. Deny-on-presence Rego policies that rely on the presence of certain fields in the parsed body fail open, allowing the full forbidden payload to reach upstream services. The issue is confirmed by Skipper's unit tests and real proxy test harnesses. The vulnerability affects versions of Skipper prior to 0.27.26.

Deployments that use opaAuthorizeRequestWithBody with deny-on-presence Rego policies can be bypassed by sending requests with bodies larger than the configured max request body size. The OPA policy evaluates an empty parsed body and incorrectly allows the request, while the full payload is forwarded upstream. This can lead to unauthorized actions being performed, such as bypassing delete action restrictions. The vulnerability does not cause remote code execution but can lead to significant authorization bypass.

A fix is available in Skipper version 0.27.26. Users should upgrade to this version or later. Additionally, policy authors must explicitly check the input.attributes.request.http.truncated_body attribute in their Rego policies to detect and block or deny requests with oversized bodies. Example mitigations include denying requests if truncated_body is true or allowing requests only if truncated_body is false. Refer to the official Skipper documentation at https://github.com/zalando/skipper/releases/tag/v0.27.26 for detailed guidance.