An unauthenticated security bypass vulnerability in Zalando Skipper allows attackers to circumvent OPA policy enforcement, potentially leading to unauthorized data access.

The flaw exists in the opaAuthorizeRequestWithBody filter where oversized request bodies bypass Rego policy checks. An unauthenticated attacker can trigger this by exceeding the configured body size limit, causing the filter to forward the request to the upstream service without successful policy validation.

Successful exploitation allows an attacker to bypass critical security authorization policies, potentially resulting in unauthorized access to sensitive downstream services. Given the CVSS score of 8.2, this vulnerability represents a high risk to organizational data confidentiality and integrity, particularly for environments relying on OPA for granular request-level access control.

Immediate Action: Update Zalando Skipper to version 0.27.35 or later to resolve the logic error in the authorization filter.

Proactive Monitoring: Review application logs for requests that exceed the defined maximum request body size or exhibit unusual HTTP header patterns associated with OPA bypass attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress controller rule to reject requests that exceed the 1 MB body size threshold if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the security posture of service architectures utilizing Skipper and OPA. Administrators are strongly urged to prioritize the update to version 0.27.35 to ensure that authorization policies are correctly enforced for all incoming traffic, regardless of request size.