GitHub Advisoryadvisory · Maven

GHSA-27h3-crw2-q36w SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information

HIGH Published 2026-04-16 Modified 2026-04-16 Official page ↗
Aliases
CVE-2026-30778
Ecosystem
Maven
Packages
org.apache.skywalking:server-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-202
Reviewed
2026-04-16

Affected packages

• Maven org.apache.skywalking:server-core: >= 9.7.0, < 10.4.0 → fixed in 10.4.0

Description

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-30778 The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. vulnerability

Weakness · CWE (1)

  • CWE-202 Exposure of Sensitive Information Through Data Queries weakness

References