Zalando Skipper is vulnerable to a security policy bypass caused by an incomplete fix, allowing oversized request bodies to circumvent Open Policy Agent enforcement.

This vulnerability involves improper input validation where oversized request bodies exceed the configured maxBodyBytes limit. Because Skipper forwards these payloads to the upstream service while OPA evaluates an empty body, security policies are effectively bypassed.

With a CVSS score of 8.2, this vulnerability allows attackers to bypass critical security enforcement mechanisms. If OPA policies are used to restrict access or validate input, an attacker can deliver malicious payloads that would otherwise be blocked, leading to potential unauthorized access or service disruption in downstream applications.

Immediate Action: Update Zalando Skipper to the latest version that addresses this regression.

Proactive Monitoring: Review traffic logs for requests that contain unusually large bodies or that appear to bypass existing security policies.

Compensating Controls: If an immediate update is not feasible, implement request size limits at the load balancer or WAF level to prevent oversized payloads from reaching the Skipper service.

Public Exploit Available: No

Security teams must prioritize updating the Skipper deployment to ensure that security policies are consistently enforced. Failure to patch may result in a complete bypass of the organization's policy-based security framework.