Go/github.com/zalando/skipper CVE-2026-50197: high 7.8, EPSS 0.51%

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper

Action: Upgrade github.com/zalando/skipper to 0.26.10 or later.

go get github.com/zalando/skipper@v0.26.10

Affected

Fixed versions

Sources

• osv: GO-2026-5944
• nvd: CVE-2026-50197
• https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf

CVE-2026-50197 · published 2026-07-17T19:42:05Z · modified 2026-07-21T19:15:27.800057230Z · JSON