PT-2026-33053 · Apache · Apache Skywalking

[e-mail] · Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-30778

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache SkyWalking versions 9.7.0 through 10.3.0

Description The SkyWalking OAP '/debugging/config/dump' endpoint may leak sensitive configuration information related to MySQL or PostgreSQL.

Recommendations Upgrade to version 10.4.0.

Fix

Weakness Enumeration

CWE-202

Related Identifiers

CVE-2026-30778

GHSA-27H3-CRW2-Q36W

Affected Products

Apache Skywalking

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-30778 · Security Note
• https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27h3-crw2-q36w · Vendor Advisory
• https://github.com/apache/skywalking/commit/5a3f6260e4dd681a9132204e5299064bef079886 · Note
• https://github.com/apache/skywalking · Note
• https://twitter.com/CVEnew/status/2044737989327114481 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/15/2 · Note
• https://twitter.com/oss_security/status/2044454644743610669 · Twitter Post