[GHSA-8qqm-fp2q-v734] Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

[deepakravisankar]

Updates

• CWEs

Comments
This advisory has no CWE assigned ("cwe_ids": []). Adding three, primary first, based on the advisory description and the pre-/post-fix source.

CWE-636 (Not Failing Securely, 'Failing Open') — primary. The advisory's own wording is that deny-on-presence Rego policies "fail OPEN": on the oversized-body path OPA receives an empty parsed_body, so the authorization decision falls back to the more permissive outcome while the full payload still reaches the upstream.

CWE-863 (Incorrect Authorization). The authorization check does execute — it just evaluates an empty document and therefore decides incorrectly. This fits better than CWE-285, since the check is performed rather than skipped.

CWE-754 (Improper Check for Unusual or Exceptional Conditions). The incomplete CVE-2026-50197 fix reasoned only about the ContentLength == -1 case; the oversized-declared-length branch was never handled, and the accompanying regression test covered only small bodies.

Evidence: in v0.27.25, filters/openpolicyagent/openpolicyagent.go ExtractHttpBodyOptionally sets expectedSize := req.ContentLength, special-cases only expectedSize < 0 (chunked / HTTP/2), then gates body extraction on expectedSize <= opa.maxBodyBytes — so a declared Content-Length greater than maxBodyBytes skips extraction entirely and OPA receives a nil body. v0.27.26 removes that gate, reading and truncating to maxBodyBytes so the policy can compare bytes-read against the declared Content-Length.

No other fields changed: severity (High/8.2), affected range (< 0.27.26, patched 0.27.26), description, and references are left as published. Note on the range specifically — the pre-fix v0.26.9 gate was req.ContentLength <= opa.maxBodyBytes, so an oversized declared Content-Length fell through there too; the bypass predates the CVE-2026-50197 fix, so "introduced": "0" is correct.

[github]

Hi there @szuecs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Adds CWE classifications to accurately describe the advisory’s fail-open authorization bypass.

Changes:

• Adds CWE-636, CWE-754, and CWE-863.
• Updates the advisory modification timestamp.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[szuecs]

@ghost I let the researchers define this and normally they suggest it when they create the advisory. I argue when I can't follow or disagree.

What we agree on with the envoy team is that the policy should own the decision what it wants to do in case of oversized bodies, and we have to make sure that this option is correctly passed to the policy.