A critical authentication bypass flaw has been identified in HTTP body authorization filters, posing a high risk to network routing infrastructure. The vulnerability stems from an incomplete mitigation fix where body truncation controls fail to signal properly under specific transfer encodings. When processing requests without explicit content length headers, authorization policies fail open and allow uninspected data through. Affected deployments face significant security risks as unauthorized traffic bypasses policy checks. Organizations relying on impacted body-inspecting authorization mechanisms should review their policy configurations immediately.
CVE-2026-86043: An incorrect authorization vulnerability exists in the opaAuthorizeRequestWithBody filter within the filters/openpolicyagent/openpolicyagent.go component and related plugin handlers. The flaw occurs because the truncated_body flag is evaluated only when a content-length header is explicitly provided in the HTTP request. Requests transmitted using HTTP/1.1 chunked encoding or HTTP/2 omit this header, causing the system to incorrectly mark the body as non-truncated even after truncation takes place. Consequently, policies configured to deny or validate truncated payloads evaluate to true, bypassing authorization and forwarding the complete, un-inspected request body to backend services.[/subscribe_to_unlock_form]
A critical authentication bypass flaw has been identified in HTTP body authorization filters, posing a high risk to network routing infrastructure. The vulnerability stems from an incomplete mitigation fix where body truncation controls fail to signal properly under specific transfer encodings. When processing requests without explicit content length headers, authorization policies fail open and allow uninspected data through. Affected deployments face significant security risks as unauthorized traffic bypasses policy checks. Organizations relying on impacted body-inspecting authorization mechanisms should review their policy configurations immediately.
CVE-2026-86043: An incorrect authorization vulnerability exists in the opaAuthorizeRequestWithBody filter within the filters/openpolicyagent/openpolicyagent.go component and related plugin handlers. The flaw occurs because the truncated_body flag is evaluated only when a content-length header is explicitly provided in the HTTP request. Requests transmitted using HTTP/1.1 chunked encoding or HTTP/2 omit this header, causing the system to incorrectly mark the body as non-truncated even after truncation takes place. Consequently, policies configured to deny or validate truncated payloads evaluate to true, bypassing authorization and forwarding the complete, un-inspected request body to backend services.[emaillocker id="1283"]
Deployments using impacted body-authorization filters should apply defensive measures to ensure uninspected traffic is stopped at the ingress point.
We recommend you to update Skipper to version 0.27.37.
The following reports contain further technical details:
[/emaillocker]