GitHub Advisoryadvisory · Go

GHSA-c4hg-6933-x62x Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

HIGH Published 2026-04-13 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-34476
Ecosystem
Go
Packages
github.com/apache/skywalking-mcp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-04-14

Affected packages

• Go github.com/apache/skywalking-mcp: < 0.2.0 → fixed in 0.2.0

Description

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-34476 Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References