VulnWatch VulnWatch
← Back to dashboard
High github · GHSA-5gpm-rgj3-9q76

Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Published Sep 17, 2026 CVSS 7.5
  • Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody.
  • Affected versions: `
Auth Bypass

Affected AI Products

adversarial
View original source
Get the weekly digest. Every Monday: top AI security stories of the week. Free.