Skipper: OPA body policies authorize oversized requests because truncated_body is derived from Content-Length

Impact

The opaAuthorizeRequestWithBody filter truncates request bodies at maxBodyBytes before handing them to Open Policy Agent, but the input.truncated_body signal is computed from Content-Length rather than from what was actually read, and the envoy adapter copies headers without writing a Content-Length that reflects the truncation. For an HTTP/1.1 chunked request or an HTTP/2 request with no Content-Length, a body-inspecting policy that follows the documented mitigation and only permits requests where truncated_body is false will evaluate the prefix, allow the request, and Skipper forwards the entire oversized body upstream. Where Skipper is the ingress in front of inference or control-plane services, this is a policy bypass at the edge - the authorization decision was made on content the upstream never receives in full. Distinct from CVE-2026-50197, which it follows.

Who can reach it

Anyone who can send requests to a Skipper route using opaAuthorizeRequestWithBody, unauthenticated, using chunked transfer encoding or HTTP/2 without Content-Length. Reachability equals whatever the ingress is exposed to.

What to do

Upgrade Skipper to 0.27.37 or later and restart the proxy instances - a rolling restart of the ingress deployment, no node work. Advisory-level mitigation in the meantime is to not rely on input.truncated_body alone for body-inspecting OPA policies.

References

Related entries

• Envoy: Type-confusion in default certificate validationCVE-2022-21656 · EnvoyHigh
• Rancher: Missing authorization allows an authenticated user to create a shell pod with kubectl accessCVE-2022-21953 · RancherHigh
• CRI-O: restored checkpoints re-apply archive mounts, bypassing pod-spec host mount validationCVE-2024-8676 · CRI-O (container checkpoint/restore endpoint)High
• Podman: files written to bind mounts during build persist in the host build context directoryCVE-2025-4953 · Podman (podman build, RUN --mount=type=bind)High
• BentoML (bentofile.yaml path fields: description, docker.setup_script, docker.dockerfile_templateCVE-2026-24123 · BentoMLHigh
• OpenShift Console: tenant-planted Helm repository makes the console pod fetch arbitrary URLs server-sideCVE-2026-50237 · Red Hat OpenShift Console (Helm catalog proxy, ProjectHelmChartRepository)High