CVE-2026-30778
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.54%
- CWE
- CWE-202
- Published
- 2026-04-15
- Last modified
- 2026-04-16
Affected products
- Apache Software Foundation Apache SkyWalking
Weakness type
Related vulnerabilities
- CVE-2026-16520 — Improper input validation and Exposure of sensitive information through data queries vulnerability...
- CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
- CVE-2026-70473 — Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
- CVE-2026-42797 — Apache Syncope: JexlContextBuilder Information Disclosure
- CVE-2026-40245 — Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- CVE-2026-33530 — InvenTree Vulnerable to ORM Filter Injection
- CVE-2026-3546 — e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
- CVE-2026-25050 — Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy