[GHSA-8qqm-fp2q-v734] Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

[deepakravisankar]

Updates

• CWEs

Comments
This advisory currently has no CWE assigned ("cwe_ids": []). Proposing four, primary first, based on the advisory description and the pre-/post-fix source.

CWE-636 (Not Failing Securely, 'Failing Open') — primary. The advisory's own wording is that deny-on-presence Rego policies "fail OPEN": on the oversized-body path OPA receives an empty parsed_body, so the authorization decision falls back to the more permissive outcome while the full payload still reaches the upstream.

CWE-863 (Incorrect Authorization). The authorization check does execute — it just evaluates an empty document and therefore decides incorrectly. This fits better than CWE-285, since the check is performed rather than skipped.

CWE-130 (Improper Handling of Length Parameter Inconsistency). Root cause is the handling of a declared Content-Length inconsistent with the bytes actually made available to the policy engine. In v0.27.25, filters/openpolicyagent/openpolicyagent.go sets expectedSize := req.ContentLength, special-cases only expectedSize < 0 (chunked / HTTP/2), then gates body extraction on expectedSize <= opa.maxBodyBytes; a declared Content-Length greater than maxBodyBytes skips extraction entirely and yields a nil body.

CWE-754 (Improper Check for Unusual or Exceptional Conditions). The incomplete CVE-2026-50197 fix reasoned only about the ContentLength == -1 case; the oversized-declared-length branch was never handled, and the accompanying regression test covered only small bodies.

Fix confirmation: v0.27.26 removes the expectedSize <= maxBodyBytes gate so oversized bodies are read and truncated to maxBodyBytes, letting the policy compare bytes-read against the declared Content-Length.

Affected range left unchanged: the pre-fix v0.26.9 gate was req.ContentLength <= opa.maxBodyBytes, so an oversized declared Content-Length fell through there too. The bypass predates the CVE-2026-50197 fix, so "introduced": "0" is correct.

[Copilot]

Pull request overview

Adds CWE classifications to the Skipper oversized-body authorization bypass advisory.

Changes:

• Adds four proposed CWE mappings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[deepakravisankar]

Note for reviewers: this supersedes #9160 (now closed), which was the original improvement for this advisory.

#9160 carried two problems that are fixed here:

• CWE-130 was included; removed per the review feedback on [GHSA-8qqm-fp2q-v734] Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies #9160. The attacker sends an accurate Content-Length and Skipper compares it against the policy cap (expectedSize <= opa.maxBodyBytes in filters/openpolicyagent/openpolicyagent.go @ v0.27.25), so there is no length/data inconsistency — the OPA-vs-upstream divergence is a downstream consequence of the skipped extraction, not the weakness class.
• An unintended modified timestamp change; this PR leaves modified at the upstream value, so the diff is the single cwe_ids field.

Resulting set: CWE-636 (primary, fail-open) · CWE-863 (incorrect authorization) · CWE-754 (unhandled oversized branch in the incomplete CVE-2026-50197 fix).

Affected range intentionally unchanged: the pre-fix v0.26.9 gate was req.ContentLength <= opa.maxBodyBytes, so an oversized declared Content-Length fell through there too. The bypass predates the CVE-2026-50197 fix, so "introduced": "0" is correct.

[deepakravisankar]

Created #9162 for the same