Skip to content
Apache Software Foundation Skywalking vulnerabilities
-
apache software foundation skywalking banyandb
Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
CVE-2026-85499
9.1 Critical
-
apache software foundation skywalking
Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
CVE-2026-85229
6.1 Medium
-
apache software foundation skywalking
Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP
CVE-2026-71216
5.3 Medium
-
apache skywalking mcp
Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server
CVE-2026-34884
9.8 Critical
-
apache skywalking
Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
CVE-2026-30778
Fix available
7.5 High
-
apache skywalking mcp
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
CVE-2026-34476
Fix available
7.1 High
-
apache skywalking
Apache SkyWalking: Stored XSS vulnerability
CVE-2025-54057
6.1 Medium
-
apache skywalking nodejs agent
Service unavailability impact in NodeJS agent(version <= 0.5.0)
CVE-2022-36127
Fix available
7.5 High
-
apache skywalking
SQL Injection in Apache SkyWalking
CVE-2020-13921
Fix available
EPSS 33.5%
9.8 Critical
-
apache skywalking
**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through...
CVE-2020-9483
Public exploit
EPSS 34.1%
7.5 High