The opaAuthorizeRequestWithBody filter in Skipper fails to inspect request bodies when the request uses the Transfer-Encoding: chunked header in HTTP/1.1 or omits the content-length pseudo‑header in HTTP/2. The filter produces an empty raw_body and parsed_body, so the upstream service receives the full, attacker‑controlled bodies that are not evaluated against OPA rules, potentially allowing unauthorized operations that rely on policy‑level controls.

All versions of Zalando Skipper older than 0.26.10 are affected. Users of the open‑source Skipper HTTP router and reverse proxy running any pre‑0.26.10 release must assess whether the opaAuthorizeRequestWithBody filter is enabled and whether their deployments accept chunked or HTTP/2 requests without a content-length header.

The vulnerability scores a CVSS of 7.8, indicating a high severity. The EPSS score is below 1%, suggesting a low probability that attackers are actively exploiting it today, and it is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward for remote actors: a crafted chunked or HTTP/2 request to the Skipper instance with an unverified body will bypass OPA policy enforcement. The lack of a content‑length header is a typical configuration case in many services, making this flaw exploitable in real‑world deployments that rely on OPA for security validation.