Executive brief
Apache SkyWalking, an application performance monitoring tool, contains a vulnerability where a specific debugging endpoint can leak sensitive database configuration details. An unauthorized user could access this endpoint to view credentials or connection strings for MySQL and PostgreSQL databases. This exposure could lead to unauthorized database access and potential data theft.
Technical details
An information disclosure vulnerability exists in Apache SkyWalking OAP's '/debugging/config/dump' endpoint. The root cause is the improper handling of 'second level properties' within the configuration dump logic, which fails to mask sensitive data when requested. A remote, unauthenticated attacker can query this endpoint over the network to retrieve sensitive configuration parameters, including credentials for MySQL and PostgreSQL backends. This issue is classified under CWE-202 (Exposure of Sensitive Information Through Data Queries). The vulnerability is patched in version 10.4.0.
Affected products
- Apache SkyWalking OAP (server-core) 9.7.0 - 10.3.0
Timeline
- 2026-03-05: patched: Fix committed to GitHub repository
- 2026-04-15: advisory: NVD and Apache mailing list disclosure
- 2026-04-16: disclosed: GitHub Advisory published