CVE-2026-30778
Information Disclosure via /debugging/config/dump in Apache SkyWalking
Publication date: 2026-04-15
Last updated on: 2026-04-20
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | skywalking | From 9.7.0 (inc) to 10.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-202 | When trying to keep information confidential, an attacker can often infer some of the information by using statistics. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Apache SkyWalking versions 9.7.0 through 10.3.0 involves the potential leakage of sensitive configuration information related to MySQL and PostgreSQL databases via the /debugging/config/dump endpoint.
Exposure of sensitive configuration data could potentially lead to unauthorized access or data breaches, which may impact compliance with data protection standards and regulations such as GDPR and HIPAA that require safeguarding sensitive information.
Users are advised to upgrade to version 10.4.0, where this issue is fixed, to mitigate the risk and help maintain compliance with such standards.
Can you explain this vulnerability to me?
CVE-2026-30778 is a vulnerability in Apache SkyWalking versions 9.7.0 through 10.3.0. It exists in the SkyWalking OAP's /debugging/config/dump endpoint, which may leak sensitive configuration information related to MySQL and PostgreSQL databases.
How can this vulnerability impact me? :
This vulnerability can lead to the exposure of sensitive database configuration information, which could be exploited by attackers to gain unauthorized access or further compromise the affected systems. The risk is considered to be of moderate severity.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be mitigated by upgrading Apache SkyWalking to version 10.4.0, which contains the fix for this issue.
Users running versions from 9.7.0 through 10.3.0 are advised to perform this upgrade as soon as possible to prevent sensitive configuration information leakage.