CVE-2026-86043: Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
Skipper’s opaAuthorizeRequestWithBody filter authorizes requests by handing the (bounded) request body to Open Policy Agent. When a body exceeds -open-policy-agent-max-request-body-size (default 1 MB), Skipper truncates it before OPA sees it. Advisory GHSA-8qqm-fp2q-v734 established that deny-on-presence / body-inspecting policies fail OPEN on oversized bodies, and its remediation instructs policy authors to guard on input.attributes.request.http.truncated_body (implemented as the top-level input.truncated_body):
default allow := false
allow if {
input.truncated_body == false
References
- github.com/advisories/GHSA-5gpm-rgj3-9q76
- github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
- github.com/zalando/skipper/releases/tag/v0.27.35
- github.com/zalando/skipper/releases/tag/v0.27.37
- github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76
- github.com/zalando/skipper/tree/v0.27.35
- nvd.nist.gov/vuln/detail/CVE-2026-86043
Code Behaviors & Features
Detect and mitigate CVE-2026-86043 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →