CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Attackers can bypass Open Policy Agent authorization in Skipper by sending chunked or HTTP/2 requests that exploit flawed body truncation logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86043?
CVE-2026-86043 is a high-severity authentication bypass vulnerability in zalando skipper, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
Weakness: CWE-863
Which versions are affected by CVE-2026-86043?
3 open source packages ship an affected version, including github.com/zalando/skipper.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zalando/skipper Go | All versions | 0.27.37 |
github.com/zalando/skipper Go | All versions | 0.27.37 |
github.com/zalando/skipper Go | All versions | 0.27.37 |
How do I fix CVE-2026-86043?
Upgrade github.com/zalando/skipper to 0.27.37 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-86043 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86043 exists.
Sources
Also known as GHSA-5gpm-rgj3-9q76, GO-2026-6495.