Executive brief
Apache SkyWalking's PagerDuty alarm integration sends sensitive routing credentials over unencrypted HTTP before attempting HTTPS redirection. An attacker with network access to traffic between SkyWalking and PagerDuty can intercept and capture the integration routing key, enabling unauthorized access to send alerts and potentially compromise incident response workflows.
Technical details
Apache SkyWalking's PagerDuty alarm hook implementation transmits HTTP POST requests containing the integration routing key to an endpoint that serves HTTPS but accepts plain HTTP. The vulnerability stems from the fact that the initial unencrypted POST request—including the JSON body with the sensitive routing key—is transmitted before any HTTPS redirect response is issued, meaning the credentials are exposed to network interception. An unauthenticated network attacker positioned on the network path (via MITM, compromised network infrastructure, or traffic sniffing on shared networks) can capture the routing key in cleartext. The fix is available in version 11.0.0, which presumably enforces HTTPS-only communication or pre-validates connections before transmitting secrets.
Affected products
- Apache SkyWalking 9.6.0 through 11.0.0
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 11.0.0 resolves the issue