{"action":"Upgrade github.com/zalando/skipper to 0.27.37 or later.","affected":[{"fixed":"0.27.37","introduced":"0"}],"component":"github.com/zalando/skipper","cve_ids":["CVE-2026-86043"],"ecosystem":"Go","epss":0.00451,"exploited":false,"fixed_versions":["0.27.37"],"ghsa_id":"GHSA-5gpm-rgj3-9q76","id":"tcs_01M5KGV23D0JGDCQCPQNVKXVFJ","modified_at":"2026-09-28T17:00:16.898508262Z","published_at":"2026-09-28T16:43:40Z","references":["https://osv.dev/vulnerability/GO-2026-6495","https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76","https://nvd.nist.gov/vuln/detail/CVE-2026-86043","https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507","https://github.com/zalando/skipper/releases/tag/v0.27.35","https://github.com/zalando/skipper/releases/tag/v0.27.37","https://github.com/zalando/skipper/tree/v0.27.35"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6495","url":"https://osv.dev/vulnerability/GO-2026-6495"}],"summary":"Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper"}