CVE-2026-65604 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
Attackers can bypass Open Policy Agent security rules by sending oversized request bodies, allowing forbidden actions to proceed unenforced.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65604?
CVE-2026-65604 is a high-severity vulnerability in zalando skipper, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.
Weakness: CWE-20
Which versions are affected by CVE-2026-65604?
How do I fix CVE-2026-65604?
No fix has been published for CVE-2026-65604 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-65604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65604 exists.
Sources
Also known as GHSA-p75f-h73c-3rcp.