[GHSA-8qqm-fp2q-v734] Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

[deepakravisankar]

Updates

• CWEs

Comments
This advisory has no CWE assigned ("cwe_ids": []). Adding three, primary first, based on the advisory description and the pre-/post-fix source.

CWE-636 (Not Failing Securely, 'Failing Open') — primary. The advisory's own wording is that deny-on-presence Rego policies "fail OPEN": on the oversized-body path OPA receives an empty parsed_body, so the authorization decision falls back to the more permissive outcome while the full payload still reaches the upstream.

CWE-863 (Incorrect Authorization). The authorization check does execute — it just evaluates an empty document and therefore decides incorrectly. This fits better than CWE-285, since the check is performed rather than skipped.

CWE-754 (Improper Check for Unusual or Exceptional Conditions). The incomplete CVE-2026-50197 fix reasoned only about the ContentLength == -1 case; the oversized-declared-length branch was never handled, and the accompanying regression test covered only small bodies.

Evidence: in v0.27.25, filters/openpolicyagent/openpolicyagent.go ExtractHttpBodyOptionally sets expectedSize := req.ContentLength, special-cases only expectedSize < 0 (chunked / HTTP/2), then gates body extraction on expectedSize <= opa.maxBodyBytes — so a declared Content-Length greater than maxBodyBytes skips extraction entirely and OPA receives a nil body. v0.27.26 removes that gate, reading and truncating to maxBodyBytes so the policy can compare bytes-read against the declared Content-Length.

No other fields changed: severity (High/8.2), affected range (< 0.27.26, patched 0.27.26), description, and references are left as published. Note on the range specifically — the pre-fix v0.26.9 gate was req.ContentLength <= opa.maxBodyBytes, so an oversized declared Content-Length fell through there too; the bypass predates the CVE-2026-50197 fix, so "introduced": "0" is correct.

[github]

Hi there @szuecs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Adds CWE classifications to accurately describe the advisory’s fail-open authorization bypass.

Changes:

• Adds CWE-636, CWE-754, and CWE-863.
• Updates the advisory modification timestamp.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.