PT-2026-32336 · Apache · Apache Skywalking Mcp

Andrea Cosentino · Published 2026-04-13 · Updated 2026-04-13 · CVE-2026-34476

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache SkyWalking MCP version 0.1.0

Description Server-Side Request Forgery occurs via the 'SW-URL' header.

Recommendations Upgrade to version 0.2.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34476

GHSA-C4HG-6933-X62X

Affected Products

Apache Skywalking Mcp

References · 7

• https://lists.apache.org/thread/v0k1xyzzbtnpyrwxwyn36pbspr8rhjnr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c4hg-6933-x62x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34476 · Security Note
• https://github.com/apache/skywalking-mcp · Note
• http://openwall.com/lists/oss-security/2026/04/13/4 · Note
• https://twitter.com/CVEnew/status/2043733053445714333 · Twitter Post
• https://twitter.com/oss_security/status/2043699263624892632 · Twitter Post