Skip to content
Threat Feed
Subscribe

Vendor

Zalando

1 brief RSS
high advisory

Zalando Skipper OPA Policy Bypass via Chunked Encoding

A critical vulnerability in `zalando/skipper`'s OpenPolicyAgent integration, tracked as GHSA-659f-rgp5-w4wf, allows attackers to bypass `opaAuthorizeRequestWithBody` policies using HTTP/1.1 `Transfer-Encoding: chunked` or HTTP/2 requests lacking a `content-length` pseudo-header, leading to unauthorized access to upstream services with uninspected payloads.

skipper vulnerability api-gateway security-bypass opa network
1r 1t