CVE-2026-30778: Apache SkyWalking Info Disclosure Bug

CVE-2026-30778 Overview

A sensitive information disclosure vulnerability exists in Apache SkyWalking OAP (Observability Analysis Platform) where the /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL database connections. This vulnerability allows unauthenticated remote attackers to access potentially critical database credentials and configuration details through the debugging endpoint.

Critical Impact

Exposure of database credentials and configuration information could enable attackers to gain unauthorized access to backend MySQL or PostgreSQL databases, potentially leading to data breaches, data manipulation, or further lateral movement within the infrastructure.

Affected Products

• Apache SkyWalking OAP 9.7.0 through 10.3.0

Discovery Timeline

• 2026-04-15 - CVE-2026-30778 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-30778

Vulnerability Analysis

This vulnerability is classified as CWE-202 (Exposure of Sensitive Information Through Data Queries), representing a configuration information disclosure flaw in Apache SkyWalking's debugging functionality. The /debugging/config/dump endpoint is designed for diagnostic purposes but fails to properly sanitize or restrict access to sensitive database configuration parameters.

When accessed, the endpoint returns configuration data that may include MySQL or PostgreSQL connection strings, usernames, passwords, and other sensitive database connection parameters. The vulnerability requires no authentication and can be exploited over the network without any user interaction, making it particularly dangerous in environments where the SkyWalking OAP service is exposed to untrusted networks.

Root Cause

The root cause of this vulnerability lies in the improper handling of sensitive configuration data within the debugging endpoint. The /debugging/config/dump functionality was implemented without adequate access controls or data sanitization, allowing the endpoint to return raw configuration values that include database credentials. This represents a failure to implement the principle of least privilege and proper secrets management in the debugging interface.

Attack Vector

An attacker can exploit this vulnerability by sending an HTTP request to the /debugging/config/dump endpoint on a vulnerable SkyWalking OAP instance. The attack is network-based and requires no authentication or special privileges. If the OAP service is accessible from the internet or an untrusted network segment, an attacker can simply issue a GET request to retrieve sensitive configuration data including database connection information.

The exploitation is straightforward—a simple HTTP request to the vulnerable endpoint returns the configuration dump containing potentially sensitive database credentials for MySQL or PostgreSQL backends. Organizations exposing SkyWalking OAP debugging endpoints to untrusted networks are at immediate risk.

Detection Methods for CVE-2026-30778

Indicators of Compromise

• Unusual HTTP requests to the /debugging/config/dump endpoint from external or unauthorized IP addresses
• Access logs showing repeated queries to debugging endpoints
• Unexpected database authentication attempts using credentials that should only be known to the SkyWalking application
• Evidence of data exfiltration following successful configuration dump access

Detection Strategies

• Monitor web server and application logs for requests to /debugging/config/dump endpoint
• Implement network-level detection rules to alert on access attempts to SkyWalking debugging endpoints from untrusted sources
• Review database authentication logs for connection attempts from unexpected sources that may indicate credential theft
• Deploy web application firewall (WAF) rules to block or alert on requests to sensitive debugging endpoints

Monitoring Recommendations

• Enable detailed access logging on Apache SkyWalking OAP instances
• Configure alerting for any access to debugging endpoints from non-administrative networks
• Implement database activity monitoring to detect unauthorized access using potentially leaked credentials
• Establish baseline network traffic patterns to identify anomalous requests to management and debugging interfaces

How to Mitigate CVE-2026-30778

Immediate Actions Required

• Upgrade Apache SkyWalking to version 10.4.0 or later, which contains the fix for this vulnerability
• Restrict network access to SkyWalking OAP debugging endpoints using firewall rules or network segmentation
• Review access logs for any prior exploitation attempts against the /debugging/config/dump endpoint
• Rotate database credentials if there is any possibility of prior unauthorized access to the configuration dump endpoint

Patch Information

Apache has released version 10.4.0 of SkyWalking which addresses this vulnerability. Users running affected versions (9.7.0 through 10.3.0) should upgrade immediately. Additional details are available in the Apache Mailing List Thread and the Openwall OSS Security Update.

Workarounds

• Block access to the /debugging/config/dump endpoint at the network or reverse proxy level until patching is complete
• Implement authentication requirements for all debugging endpoints using a reverse proxy or API gateway
• Isolate SkyWalking OAP instances to internal networks only, ensuring debugging endpoints are not accessible from untrusted networks
• Consider disabling debugging endpoints entirely in production environments if they are not required for operational purposes

# Example: Block access to debugging endpoint using iptables (adjust for your environment)
# Restrict access to SkyWalking OAP port from external networks
iptables -A INPUT -p tcp --dport 12800 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 12800 -j DROP

# Example: Nginx reverse proxy configuration to block debugging endpoints
# Add to server block configuration
location /debugging/ {
    deny all;
    return 403;
}