[GHSA-8qqm-fp2q-v734] Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

[deepakravisankar]

Updates

• CWEs

Comments
Justification comment (paste as-is)

This advisory currently has no CWE assigned. Proposing four, primary first,
based on the advisory description and the pre/post-fix source.

CWE-636 (Not Failing Securely / 'Failing Open') — primary.
The advisory's own wording is that deny-on-presence Rego policies "fail OPEN":
on the oversized-body path OPA receives an empty parsed_body, so the
authorization decision falls back to the more permissive outcome while the full
payload reaches the upstream. This matches CWE-636 near-verbatim.

CWE-863 (Incorrect Authorization).
The authorization check does execute — it simply evaluates against an empty
document and therefore decides incorrectly. CWE-863 fits better than CWE-285,
since the check is performed rather than skipped.

CWE-130 (Improper Handling of Length Parameter Inconsistency).
Root cause is the handling of a declared Content-Length that is inconsistent
with the bytes actually made available to the policy engine. In v0.27.25,
filters/openpolicyagent/openpolicyagent.go sets expectedSize := req.ContentLength,
special-cases only expectedSize < 0 (chunked/HTTP2), and then gates body
extraction on expectedSize <= opa.maxBodyBytes. A declared Content-Length
greater than maxBodyBytes skips extraction entirely and yields a nil body.

CWE-754 (Improper Check for Unusual or Exceptional Conditions).
The incomplete CVE-2026-50197 fix reasoned only about the ContentLength == -1
case; the oversized-declared-length branch was never handled, and the
accompanying regression test covered only small bodies.

Fix confirmation: v0.27.26 removes the expectedSize <= maxBodyBytes gate so
oversized bodies are read and truncated to maxBodyBytes, letting the policy
compare bytes-read against the declared Content-Length.

Verified facts backing the submission

┌─────────────────────────────────────┬────────────────────────────────────────────────────────────────────────┐
│ Claim │ Evidence │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ cwes: [] │ Both GraphQL securityAdvisory and REST /advisories/GHSA-8qqm-fp2q-v734 │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Live, not withdrawn │ withdrawn_at: null │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ HIGH / CVSS 8.2 │ CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Only zero-CWE HIGH/CRIT Go advisory │ 1,200 advisories surveyed; 1,199 had CWEs │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Vulnerable gate │ openpolicyagent.go:1328–1334 @ v0.27.25 │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Fix removes the gate │ Same region @ v0.27.26 │
└─────────────────────────────────────┴────────────────────────────────────────────────────────────────────────┘

🔎 Verification ledger

• Verified — no write path exists: PATCH /advisories/{ghsa} → HTTP 404; no advisory mutation in GraphQL; token scopes are gist, read:org, repo, workflow.
• Verified — cwes: [], withdrawn_at: null, severity: high, CVSSv3 vector, range < 0.27.26 → patched 0.27.26, via two independent endpoints (GraphQL + REST).
• Verified — vulnerable code at v0.27.25 filters/openpolicyagent/openpolicyagent.go:1328–1334, fetched from raw.githubusercontent.com.
• Verified — v0.27.26 no longer contains the expectedSize <= maxBodyBytes gate and truncates to maxBodyBytes.
• Verified — CWE-636/863/130/754/285 names, abstractions, and descriptions from cwe-api.mitre.org.
• Corrected — my earlier summary implied Skipper's fix surfaced truncated_body; that string appears 0 times in the Go source. It is an Envoy ext_authz attribute referenced in the advisory's Rego mitigation examples, not Skipper code. CWE analysis unchanged.
• Assumed — curators accept CWE-636 as primary; CWE selection is a judgment call and they may reorder or trim 130/754.
• Couldn't confirm — whether an improvement suggestion is already pending on this advisory (GitHub exposes no API for that); check the UI before submitting.
• Couldn't confirm — whether an accepted CWE suggestion specifically yields the "security advisory credit" achievement; GitHub does not document the eligibility criteria.

[github]

Hi there @szuecs! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Adds CWE classifications to the Skipper OPA authorization-bypass advisory.

Changes:

• Adds four CWE identifiers.
• Updates the advisory modification timestamp.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

advisories/github-reviewed/2026/07/GHSA-8qqm-fp2q-v734/GHSA-8qqm-fp2q-v734.json:52

• CWE-130 is still present in the current diff despite the prior resolution to remove it. The declared Content-Length is accurate; Skipper creates the policy/upstream mismatch by skipping body extraction, so this does not meet CWE-130's length/data inconsistency condition. Retain only the fail-open, authorization, and exceptional-condition classifications.

      "CWE-130",

advisories/github-reviewed/2026/07/GHSA-8qqm-fp2q-v734/GHSA-8qqm-fp2q-v734.json:4

• The current diff still includes the modified timestamp change that the prior developer reply identified as unintended and removed during rebase. Restore the original value so this CWE-only PR does not alter unrelated advisory metadata.

  "modified": "2026-07-21T09:31:01Z",

[deepakravisankar]

Created #9162 for the same