CVE-2026-82265: Zipkin Authentication Bypass Vulnerability

CVE-2026-82265 Overview

CVE-2026-82265 affects Zipkin through version 3.6.1, a widely deployed distributed tracing system. The vulnerability exposes Spring Boot Actuator endpoints on the tracing API port without authentication. Unauthenticated attackers with network access can query these endpoints to read environment variables, bean configurations, and backend storage credentials. Attackers can also modify runtime log levels to suppress security-relevant logging. The issue is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Attackers can retrieve storage backend credentials and internal configuration data from any network-reachable Zipkin instance running version 3.6.1 or earlier.

Affected Products

OpenZipkin Zipkin server through version 3.6.1
Zipkin distributions bundling the default zipkin-server-shared.yml configuration
Deployments exposing the tracing API port to untrusted networks

Discovery Timeline

2026-08-28 - CVE-2026-82265 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82265

Vulnerability Analysis

Zipkin ships with Spring Boot Actuator enabled on the same HTTP port that serves the tracing API. The default configuration in zipkin-server-shared.yml exposes management endpoints without applying any authentication filter. Any client that can reach the tracing port can call actuator paths such as /actuator/env, /actuator/beans, /actuator/configprops, and /actuator/loggers.

The /actuator/env endpoint returns resolved Spring Environment properties. In production deployments these properties frequently include credentials for storage backends such as Elasticsearch, MySQL, or Cassandra, along with connection strings and API tokens. The /actuator/loggers endpoint accepts POST requests that change log levels at runtime, letting an attacker set noisy components to OFF and suppress evidence of follow-on activity.

Root Cause

The root cause is missing authentication for a critical management interface [CWE-306]. Zipkin binds Spring Boot Actuator to the primary service port and does not require credentials, tokens, or network restrictions by default. Operators who deploy the shipped configuration inherit an unauthenticated management surface exposed to any client that can reach the tracing endpoint.

Attack Vector

Exploitation requires only network reachability to the Zipkin API port. An attacker issues an unauthenticated HTTP GET request to /actuator/env to enumerate configuration values, including storage credentials referenced by placeholders like ${STORAGE_PASSWORD}. A POST request to /actuator/loggers/{logger.name} with a JSON body of {"configuredLevel":"OFF"} disables logging for the specified package. No user interaction, privileges, or exploit tooling are required. See the VulnCheck Advisory on Zipkin for full technical detail.

Detection Methods for CVE-2026-82265

Indicators of Compromise

Unauthenticated HTTP requests to /actuator/env, /actuator/beans, /actuator/configprops, or /actuator/heapdump in Zipkin access logs
POST requests to /actuator/loggers/* that set configuredLevel to OFF or ERROR
Sudden gaps in Zipkin application logs following actuator POST activity
Outbound authentication attempts to storage backends from unexpected source IPs after actuator scans

Detection Strategies

Inspect reverse-proxy and load-balancer logs for requests containing the /actuator/ path prefix on Zipkin service ports
Alert on any HTTP POST to /actuator/loggers/ regardless of source, since legitimate log-level changes are rare in production
Correlate actuator access with subsequent authentication anomalies against Elasticsearch, MySQL, or Cassandra backends used by Zipkin

Monitoring Recommendations

Enable request logging on Zipkin front-ends and forward events to a SIEM for retention and correlation
Baseline normal Zipkin log volume per component so that log-level suppression produces a detectable volume drop
Monitor for external scanners issuing sequential actuator path probes against tracing infrastructure

How to Mitigate CVE-2026-82265

Immediate Actions Required

Restrict network access to the Zipkin tracing API port to trusted internal ranges using firewall or security group rules
Disable Spring Boot Actuator endpoints that are not required, or move them to a separate management port bound to localhost
Rotate all storage backend credentials configured in Zipkin if actuator endpoints have been externally reachable
Review access logs for prior unauthenticated actuator requests and treat exposed credentials as compromised

Patch Information

At the time of publication the vulnerability affects Zipkin through 3.6.1. Track remediation status on OpenZipkin Issue #3835 and the OpenZipkin GitHub Repository for a fixed release. Apply the vendor-supplied update as soon as it is available.

Workarounds

Override the default configuration to limit exposed endpoints, for example management.endpoints.web.exposure.include=health,info
Bind actuator to a dedicated management port using management.server.port and restrict that port to administrative networks
Place Zipkin behind an authenticating reverse proxy that blocks the /actuator/ path prefix from untrusted clients
Set management.endpoint.env.enabled=false and management.endpoint.loggers.enabled=false if these endpoints are not operationally required

bash

# Configuration example: disable sensitive actuator endpoints in application.yml
management:
  server:
    port: 9090
    address: 127.0.0.1
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    env:
      enabled: false
    loggers:
      enabled: false
    beans:
      enabled: false
    heapdump:
      enabled: false