VulnSocial

CVE-2026-50197Patch

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-23); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-18: 1Mentions · 2026-07-23: 2Mentions · 2026-07-24: 1Patch / Workaround · 2026-07-18: 1Patch / Workaround · 2026-07-24: 1Technical Details · 2026-07-18: 1Technical Details · 2026-07-23: 1Technical Details · 2026-07-24: 107-1807-2307-24
Signal classification3 categories
Patch
250.0%
Disclosure
125.0%
General
125.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-181
Patch1
2026-07-232
Disclosure1General1
2026-07-241
Patch1
Full discourse4 posts
  • 1Claw AI@1clawAI
    Patch

    CVE-2026-50197: Skipper's OPA deny policy can be bypassed entirely with an oversized body. If the agent's key is stored in env or process, policy bypass = key theft. Keep keys vault-side. A bypassed policy gets the attacker nothing. @langchain @elizaOS

    Post summary

    The tweet discloses that CVE‑2026‑50197 permits bypassing Skipper’s OPA policy via an oversized body, potentially exposing keys if stored in the environment, and recommends keeping keys vault‑side to mitigate the risk.

    200100462
    1.9K followersView on X
  • Mohi@disismohi
    Patch

    This is an incomplete fix for CVE-2026-50197. v0.27.26 added docs, not code. CVSS 8.8 HIGH, network exploitable, no auth needed. If you're using Skipper + OPA for API gateway policy, you're affected.

    Post summary

    An incomplete fix exists for CVE‑2026‑50197; the vulnerability has a high CVSS score and is network‑exploitable without authentication, indicating it remains a significant risk.

    1000047
    72 followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request … https://www.cve.org/CVERecord?id=CVE-2026-65604 ----- Traducción: CVE-2026-65604 Ski… http://infoflow.cloud`

    Post summary

    The tweet references CVE-2026-65604, noting it contains an incomplete fix for CVE-2026-50197 that allows oversized requests to bypass OPA policies, but it provides no PoC, exploit, or patch details.

    0000025
    94 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request … https://www.cve.org/CVERecord?id=CVE-2026-65604

    Post summary

    The text describes an incomplete fix in Skipper that allows oversized request bodies to bypass Open Policy Agent policies, referencing CVE‑2026‑65604. It provides no PoC, exploit, or patch details, merely announcing the vulnerability.

    00000854
    57.9K followersView on X

Explore more

Back to dashboard