Apache SkyWalking security advisories

Security information for Apache SkyWalking

Reporting

Do you want to disclose a potential security issue for Apache SkyWalking? Send your report to the Apache Security Team.

You can read more about the security policy on:

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)

CVE-2026-85229 [CVE] [CVE json] [OSV json]

Last updated: 2026-09-04T06:50:47.909Z

Affected

  • Apache SkyWalking from 10.2.0 through 10.4.0

Description

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.

This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.

Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.

References

Credits

  • n0mi1k (reporter)

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

CVE-2026-71216 [CVE] [CVE json] [OSV json]

Last updated: 2026-09-04T00:09:39.233Z

Affected

  • Apache SkyWalking from 9.6.0 through 11.0.0

Description

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.

PagerDuty serves this endpoint over HTTPS and will
normally answer plain HTTP with a redirect. That does not remove the exposure.
The initial POST -- including the JSON body containing the routing key -- is
written to the socket unencrypted before any redirect response is received.
Redirection affects only whether the request is retried securely, not whether
the first copy left the host in the clear.

This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0.

Users are recommended to upgrade to version 11.0.0, which fixes the issue.

References

Credits

SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server

CVE-2026-34884 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-18T03:21:11.514Z

Affected

  • Apache SkyWalking MCP at 0.1.0

Description

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.

This issue affects Apache SkyWalking MCP: 0.1.0.

Users are recommended to upgrade to version 0.2.0, which fixes this issue.

References

Credits

Server-Side Request Forgery via SW-URL Header in MCP Server

CVE-2026-34476 [CVE] [CVE json] [OSV json]

Last updated: 2026-04-13T13:00:58.883Z

Affected

  • Apache SkyWalking MCP at 0.1.0

Description

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.

This issue affects Apache SkyWalking MCP: 0.1.0.

Users are recommended to upgrade to version 0.2.0, which fixes this issue.

References

Credits

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

CVE-2026-30778 [CVE] [CVE json] [OSV json]

Last updated: 2026-04-15T10:54:23.696Z

Affected

  • Apache SkyWalking from 9.7.0 through 10.3.0

Description

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes the issue.

References

Credits

Stored XSS vulnerability

CVE-2025-54057 [CVE] [CVE json] [OSV json]

Last updated: 2026-04-13T12:24:00.847Z

Affected

  • Apache SkyWalking through 10.2.0

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.

This issue affects Apache SkyWalking: <= 10.2.0.

Users are recommended to upgrade to version 10.3.0, which fixes the issue.

References

Credits

Service unavailability impact in NodeJS agent(version <= 0.5.0)

CVE-2022-36127 [CVE] [CVE json] [OSV json]

Last updated: 2022-07-18T11:24:38.575Z

Affected

  • Apache SkyWalking NodeJS Agent from Apache SkyWalking NodeJS Agent through 0.5.0

Description

A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can’t establish the connection.

References