oss-security - CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <52ac0662-d6b5-6d39-71b8-23f00af7fa69@apache.org>
Date: Wed, 15 Apr 2026 00:24:09 +0000
From: Kai Wan <wankai@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP
 /debugging/config/dump endpoint may leak sensitive configuration
 information of MySQL/PostgreSQL. 

Severity: moderate 

Affected versions:

- Apache SkyWalking 9.7.0 through 10.3.0

Description:

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes the issue.

Credit:

shuiboye@...il.com (reporter)

References:

https://skywalking.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-30778

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.