A critical vulnerability in Zalando Skipper allows unauthenticated attackers to bypass security policies by sending oversized request bodies.

This is an improper input validation flaw where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. Because the full payload is forwarded while OPA evaluates against an empty parsed body, an unauthenticated attacker can effectively circumvent access controls.

The vulnerability carries a CVSS score of 8.2, which reflects the high risk of unauthorized policy bypass. Successful exploitation could lead to the compromise of sensitive data or unauthorized access to backend services that rely on Skipper for traffic authorization. This flaw poses a significant threat to internal security perimeters, as attackers can bypass intended access restrictions.

Immediate Action: Monitor the official Zalando Skipper GitHub security advisories for the release of a comprehensive patch, as current versions remain vulnerable.

Proactive Monitoring: Review access logs for unusually large request bodies or patterns indicative of policy bypass attempts against OPA-integrated endpoints.

Compensating Controls: Implement strict request size limits at the edge or ingress controller level to prevent oversized payloads from reaching the Skipper proxy.

Public Exploit Available: Yes, a proof-of-concept exists as noted in the vendor security advisory.

Given the high severity of this bypass vulnerability and the existence of a proof-of-concept, administrators should prioritize the implementation of request size limitations. Monitor the vendor repository closely for a definitive fix and apply it immediately upon release to restore the integrity of your security policy enforcement.