Skipper contains an incomplete fix for a previous payload‑size limitation bug that allows a client to send a request body larger than the configured maxBodyBytes. When the size limit is exceeded, Skipper forwards the entire payload to the upstream service while the Open Policy Agent evaluates an empty body, so deny‑on‑presence policies that rely on body content are not enforced. This results in a policy bypass that can enable unauthorised actions defined as forbidden by the policy. The flaw stems from lack of input validation and is classified as CWE‑20.

The vulnerability affects the Zalando Skipper reverse‑proxy. No released version contains a complete fix; the latest release v0.27.26 includes only documentation guidance. Every earlier release is therefore vulnerable, and any deployment of Skipper that relies on OPA deny‑on‑presence policies remains at risk.

The CVSS score of 8.8 reflects high severity. EPSS is below 1 %, indicating that exploitation is currently uncommon, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a network‑based request that exceeds the configured maxBodyBytes limit. Based on the description, it is inferred that an attacker can exploit the flaw over the network by sending an oversized request body to a Skipper instance that enforces OPA policies, achieving a policy bypass that may lead to privilege escalation or the execution of otherwise forbidden operations.