CVE-2026-34884: Apache SkyWalking MCP SSRF Vulnerability

CVE-2026-34884 Overview

Apache SkyWalking MCP 0.1.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the set_skywalking_url tool, combined with GraphQL expression injection. The flaw allows unauthenticated network attackers to redirect SkyWalking MCP requests to arbitrary endpoints and inject crafted GraphQL expressions. Exploitation requires no user interaction and no privileges. The Apache SkyWalking project recommends upgrading to version 0.2.0, which remediates both issues [CWE-918].

Critical Impact
Unauthenticated attackers can reach internal services, exfiltrate data via GraphQL injection, and compromise confidentiality, integrity, and availability of the MCP host.

Affected Products

Apache SkyWalking MCP 0.1.0
Fixed in Apache SkyWalking MCP 0.2.0
Model Context Protocol integrations relying on the vulnerable set_skywalking_url tool

Discovery Timeline

2026-08-18 - CVE-2026-34884 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-34884

Vulnerability Analysis

Apache SkyWalking MCP exposes tools that allow a Model Context Protocol (MCP) client to interact with a SkyWalking backend. The set_skywalking_url tool accepts a target URL used for subsequent GraphQL queries. Version 0.1.0 does not validate or restrict this URL. An attacker can point the MCP server at internal-only endpoints, cloud metadata services, or attacker-controlled hosts.

A second flaw allows injection into GraphQL expressions constructed from user-supplied parameters. Untrusted input is concatenated into GraphQL query bodies without proper escaping. This gives attackers control over query structure, variables, and returned fields. Combined with the SSRF primitive, the two flaws enable full request forgery against arbitrary GraphQL endpoints reachable from the MCP host.

Root Cause

The root cause is missing input validation on the URL parameter accepted by set_skywalking_url and unsafe string concatenation when building GraphQL requests. There is no allowlist for target hosts, no scheme restriction, and no sanitization of GraphQL operation inputs [CWE-918].

Attack Vector

An attacker with network access to the MCP server invokes set_skywalking_url with a malicious URL, then triggers a query tool that emits an injected GraphQL body. The MCP server executes the request server-side, returning responses that may include internal service data. Because MCP servers frequently run alongside developer tooling and AI agents, the SSRF can reach loopback services, private VPC endpoints, and instance metadata APIs.

No verified proof-of-concept code is publicly available. See the Apache Mailing List Discussion and the Openwall OSS-Security Update for advisory details.

Detection Methods for CVE-2026-34884

Indicators of Compromise

Outbound HTTP requests from the SkyWalking MCP process to non-SkyWalking hosts, cloud metadata IPs such as 169.254.169.254, or loopback addresses
MCP audit log entries showing set_skywalking_url invocations with unexpected schemes, ports, or hostnames
GraphQL query strings containing unusual field selections, nested introspection, or injected directives

Detection Strategies

Baseline expected SkyWalking backend URLs and alert on deviations from the allowlist
Inspect GraphQL request bodies leaving the MCP host for injected fragments, unexpected __schema calls, or malformed operations
Correlate MCP tool-invocation telemetry with downstream network flows to identify SSRF chains

Monitoring Recommendations

Forward MCP server access logs and process network telemetry to a centralized analytics pipeline for anomaly review
Monitor for authentication failures and 4xx responses from internal services that suggest SSRF probing
Track version strings of deployed Apache SkyWalking MCP packages to detect lingering 0.1.0 installs

How to Mitigate CVE-2026-34884

Immediate Actions Required

Upgrade Apache SkyWalking MCP to version 0.2.0 on all hosts running the affected package
Restrict inbound network access to the MCP server to trusted MCP clients only
Rotate credentials, tokens, and metadata service secrets that the MCP host could have reached during exposure

Patch Information

Apache has released Apache SkyWalking MCP 0.2.0, which validates the target URL accepted by set_skywalking_url and safely constructs GraphQL requests. Users of 0.1.0 should upgrade immediately. Refer to the Apache Mailing List Discussion for the official release announcement.

Workarounds

Place the MCP server behind an egress proxy that enforces an allowlist of permitted SkyWalking backend URLs
Block outbound traffic from the MCP host to cloud metadata endpoints and internal management interfaces
Disable the set_skywalking_url tool exposure to untrusted MCP clients until the upgrade is complete

bash

# Configuration example: upgrade Apache SkyWalking MCP
pip install --upgrade "apache-skywalking-mcp==0.2.0"

# Verify installed version
pip show apache-skywalking-mcp | grep -i version