Cyber Resilience

CVE-2026-30778

High

Published: 15 April 2026

Published
15 April 2026
Modified
20 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0004 13.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30778 is a high-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Apache Skywalking. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-14 (Public Access Protections).

Deeper analysis

CVE-2026-30778 is a vulnerability in the Apache SkyWalking OAP server that allows the /debugging/config/dump endpoint to leak sensitive configuration information for MySQL and PostgreSQL databases. This issue affects versions of Apache SkyWalking from 9.7.0 through 10.3.0 and is classified under CWE-202 (Observable Discrepancy), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.

An unauthenticated attacker with network access can exploit this vulnerability by directly accessing the exposed /debugging/config/dump endpoint, requiring low complexity and no user interaction. Successful exploitation enables the attacker to retrieve sensitive database configuration details, potentially exposing credentials or other critical data without impacting integrity or availability.

The Apache SkyWalking security advisory recommends upgrading to version 10.4.0, which addresses the issue by fixing the endpoint behavior. Additional details are available in the official Apache announcement at https://lists.apache.org/thread/pvf35o3tp1rqhmrhzj6fg31gvqrqcvn3 and the OSS-Security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/15/2.

EU & UK References

Vulnerability details

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

CWE(s)
CWE-202

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The unauthenticated network-accessible /debugging/config/dump endpoint in a public-facing OAP server directly matches the definition of exploiting a public-facing application to obtain sensitive data (credentials/config).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-46586Same vendor: Apache
CVE-2026-41873Same vendor: Apache
CVE-2025-24783Same vendor: Apache
CVE-2024-53678Same vendor: Apache
CVE-2026-34059Same vendor: Apache
CVE-2026-40961Same vendor: Apache
CVE-2025-48913Same vendor: Apache
CVE-2025-65114Same vendor: Apache
CVE-2026-27446Same vendor: Apache
CVE-2025-22828Same vendor: Apache

Affected Assets

apache
skywalking
9.7.0 — 10.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the vulnerability by requiring timely identification, reporting, and remediation of flaws such as the exposed /debugging/config/dump endpoint, aligning with the upgrade to version 10.4.0.

SC-14 Public Access Protections good match
prevent

Protects publicly accessible web endpoints like /debugging/config/dump from unauthorized disclosure of sensitive database configuration information.

CM-7 Least Functionality good match
prevent

Restricts or prohibits nonessential capabilities such as debugging endpoints that leak sensitive MySQL/PostgreSQL configurations.

References