CVE-2026-82265

Received Received - Intake

Zipkin Spring Boot Actuator Endpoint Exposure

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82265

EUVD

EUVD-2026-67796

Affected Vendors & Products

Vendor	Product	Version / Range
spring	boot	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Zipkin through version 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without requiring authentication. This allows unauthenticated attackers to access sensitive information such as environment variables, bean configurations, and storage credentials. Attackers can also modify log levels to suppress logging.

Detection Guidance

Check if Zipkin's Spring Boot Actuator endpoints are exposed on the tracing API port without authentication. Use network scanning tools like nmap to identify open ports and services. Example command: nmap -sV -p <port> <target_ip>. Verify if actuator endpoints like /env, /beans, or /loggers are accessible via HTTP requests.

Impact Analysis

Unauthenticated attackers could read sensitive data like environment variables or storage credentials, potentially leading to data breaches. They could also alter log levels to hide malicious activities, making detection harder.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Disable or restrict access to Spring Boot Actuator endpoints on the tracing API port. Update Zipkin to a version that secures these endpoints. Configure network firewalls to block unauthorized access to the actuator endpoints. Ensure authentication is enforced for sensitive endpoints.

Hi! I’m here to help you understand CVE-2026-82265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70