org.apache.skywalking vulnerabilities

Products

• org.apache.skywalking/apm-webapp 1
• org.apache.skywalking/oap-server 1
• org.apache.skywalking/server-core 1

Latest org.apache.skywalking CVEs

Newest publication first

1. CVE-2026-30778 Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

   Published 2026-04-15

   High·CVSS 7.5

   The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

2. CVE-2025-54057 Apache SkyWalking: Stored XSS vulnerability

   Published 2025-11-27

   Medium·CVSS 6.1

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.

3. CVE-2020-13921 SQL Injection in Apache SkyWalking

   Published 2020-08-05

   Critical·CVSS 9.8

   Resolved Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.