Skipper : Incorrect Authorization Vulnerability - CVE-2026-86043

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37 the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go ExtractHttpBodyOptionally truncates bodies at maxBodyBytes while filters/openpolicyagent/internal/envoy/skippera