apache/skywalking · Security
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
- GHSA ID
- GHSA-27h3-crw2-q36w
- CVE ID
- CVE-2026-30778
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.
Users are recommended to upgrade to version 10.4.0, which fixes the issue.
CWEs
- CWE-202 · Exposure of Sensitive Information Through Data Queries
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-30778 ↗
- https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3 ↗
- http://www.openwall.com/lists/oss-security/2026/04/15/2 ↗
- https://github.com/apache/skywalking/commit/5a3f6260e4dd681a9132204e5299064bef079886 ↗
- https://github.com/advisories/GHSA-27h3-crw2-q36w ↗