CVE-2026-71216
Received Received - Intake

PagerDuty Alarm Hook Credential Exposure via HTTP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: Apache Software Foundation

Description
PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to the socket unencrypted before any redirect response is received. Redirection affects only whether the request is retried securely, not whether the first copy left the host in the clear. This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0. Users are recommended to upgrade to version 11.0.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-71216
EUVD
EUVD-2026-70923

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache skywalking From 9.6.0 (inc) to 11.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves PagerDuty alarm hooks sending integration routing keys over unencrypted HTTP instead of HTTPS. The initial POST request, which includes sensitive data in the JSON body, is transmitted in cleartext before any redirect to HTTPS occurs. This means the routing key is exposed during transmission.

Detection Guidance

To detect this vulnerability, monitor network traffic for unencrypted HTTP POST requests containing JSON bodies with routing keys. Use packet capture tools like tcpdump or Wireshark to inspect traffic from Apache SkyWalking instances (versions 9.6.0 to 11.0.0) to PagerDuty endpoints.

Impact Analysis

An attacker could intercept the unencrypted HTTP traffic to capture the routing key. This could allow unauthorized access to PagerDuty alerts or enable further attacks using the exposed key. Systems using Apache SkyWalking versions 9.6.0 through 11.0.0 are affected.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to the exposure of sensitive data in transit. GDPR requires protection of personal data, and HIPAA mandates secure transmission of protected health information. Unencrypted transmission violates these requirements.

Mitigation Strategies

Upgrade Apache SkyWalking to version 11.0.0 or later to address the issue. Ensure all integrations use HTTPS endpoints for PagerDuty to prevent exposure of routing keys in cleartext.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart