SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information

ALTO 7.5CVE-2026-30778 · GHSA-27h3-crw2-q36w · Published 15/04/2026 · updated 26/10/2026

In breve

CVE-2026-30778 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.apache.skywalking:server-core, skywalking (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.54%, superiore al 45.7% delle vulnerabilità.
Correzione: aggiornare a 10.4.0 o successiva.

Package	Affected versions	Patched versions
org.apache.skywalking:server-core Maven	`≥ 9.7.0, < 10.4.0`	`10.4.0`
skywalking apache	`≥ 9.7.0, < 10.4.0`	`10.4.0`

Description

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes the issue.

NVD description

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2026-30778 · ADVISORY
apache/skywalking commit 5a3f626 · WEB
apache/skywalking · PACKAGE
lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3 · WEB
openwall.com/lists/oss-security/2026/04/15/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free