CVE-2026-30778
Published: 15 April 2026
Summary
CVE-2026-30778 is a high-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Apache Skywalking. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-14 (Public Access Protections).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely identification, reporting, and remediation of flaws such as the exposed /debugging/config/dump endpoint, aligning with the upgrade to version 10.4.0.
Protects publicly accessible web endpoints like /debugging/config/dump from unauthorized disclosure of sensitive database configuration information.
Restricts or prohibits nonessential capabilities such as debugging endpoints that leak sensitive MySQL/PostgreSQL configurations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated network-accessible /debugging/config/dump endpoint in a public-facing OAP server directly matches the definition of exploiting a public-facing application to obtain sensitive data (credentials/config).
NVD Description
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.
Deeper analysisAI
CVE-2026-30778 is a vulnerability in the Apache SkyWalking OAP server that allows the /debugging/config/dump endpoint to leak sensitive configuration information for MySQL and PostgreSQL databases. This issue affects versions of Apache SkyWalking from 9.7.0 through 10.3.0 and is classified under CWE-202 (Observable Discrepancy), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
An unauthenticated attacker with network access can exploit this vulnerability by directly accessing the exposed /debugging/config/dump endpoint, requiring low complexity and no user interaction. Successful exploitation enables the attacker to retrieve sensitive database configuration details, potentially exposing credentials or other critical data without impacting integrity or availability.
The Apache SkyWalking security advisory recommends upgrading to version 10.4.0, which addresses the issue by fixing the endpoint behavior. Additional details are available in the official Apache announcement at https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3 and the OSS-Security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/15/2.
Details
- CWE(s)