high7.5
CVE-2026-30778
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
Impact
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.skywalking:server-core | >= 9.7.0, < 10.4.0 | 10.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Skywalking | from 9.7.0 before 10.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-27h3-crw2-q36w
- https://nvd.nist.gov/vuln/detail/CVE-2026-30778
- https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3
- http://www.openwall.com/lists/oss-security/2026/04/15/2
- https://github.com/apache/skywalking/commit/5a3f6260e4dd681a9132204e5299064bef079886