VulnSocial

CVE-2026-65604Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-23); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-07-23: 2Mentions · 2026-07-24: 2Patch / Workaround · 2026-07-24: 1Technical Details · 2026-07-23: 2Technical Details · 2026-07-24: 107-2307-24
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-232
Disclosure2
2026-07-242
General1Patch1
Full discourse4 posts
  • Mohi@disismohi
    General

    Your OPA policies that deny based on request body content? They're not enforcing. CVE-2026-65604 in Skipper: oversized bodies bypass policy checks entirely. No fix available. Here's what to run Friday:

    Post summary

    The post references CVE-2026-65604, noting that oversized request bodies bypass OPA policy checks in Skipper, but provides no PoC, exploit code, active exploitation evidence, or patch information.

    1000071
    72 followersView on X
  • Mohi@disismohi
    Patch

    Advisory: http://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734 If your threat model includes POST/PUT body content validation, audit your policy stack Friday. Don't wait for a fix announcement. https://nvd.nist.gov/vuln/detail/CVE-2026-65604

    Post summary

    An advisory for CVE-2026-65604 in Zalando Skipper warns that until a patch is released, users should audit their policy stack for POST/PUT body validation flaws.

    0000055
    72 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request … https://www.cve.org/CVERecord?id=CVE-2026-65604 ----- Traducción: CVE-2026-65604 Ski… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-65604 as an incomplete fix for an earlier issue, detailing a vulnerability wherein oversized request bodies bypass OPA policy enforcement, with no evidence of PoC, exploit, or active use.

    0000025
    94 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request … https://www.cve.org/CVERecord?id=CVE-2026-65604

    Post summary

    The text announces CVE‑2026‑65604, noting that oversized request bodies can bypass OPA policies and an incomplete fix exists for CVE‑2026‑50197; it offers technical details but no PoC, exploit, or evidence of wild exploitation.

    00000854
    57.9K followersView on X

Explore more

Back to dashboard