CVE-2026-30778: 
Java vulnerability analysis and mitigation

CVE-2026-30778 is an information disclosure vulnerability in Apache SkyWalking's OAP (Observability Analysis Platform) server, where the /debugging/config/dump endpoint may leak sensitive configuration information for MySQL and PostgreSQL databases. It affects Apache SkyWalking versions 9.7.0 through 10.3.0 (Maven package org.apache.skywalking:server-core). The vulnerability was disclosed on April 15, 2026, with a patch released in version 10.4.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OSS-Sec).

The root cause is classified as CWE-202 (Exposure of Sensitive Information Through Data Queries), where the /debugging/config/dump endpoint in SkyWalking OAP exposes internal configuration data without enforcing authentication or access controls. An unauthenticated remote attacker can send a simple HTTP request to this endpoint over the network to retrieve sensitive database configuration details, including credentials and connection strings for MySQL and PostgreSQL backends. No special privileges, user interaction, or complex conditions are required for exploitation. The fix was introduced in commit 5a3f626 of the Apache SkyWalking repository (GitHub Advisory, OSS-Sec).

Successful exploitation allows an unauthenticated network attacker to obtain sensitive database configuration data, potentially including credentials (usernames and passwords) and connection strings for MySQL and PostgreSQL instances used by SkyWalking. This could enable unauthorized access to backend databases, leading to data exfiltration, data manipulation, or further lateral movement within the infrastructure. The impact is limited to confidentiality — there is no direct integrity or availability impact from this vulnerability itself (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), placing it in the 13th percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible Apache SkyWalking OAP instances running versions 9.7.0 through 10.3.0 using tools like Shodan, Censys, or network scanning (e.g., nmap) targeting the default SkyWalking OAP HTTP port (typically 12800).
2. Access the debugging endpoint: Send an unauthenticated HTTP GET request to the vulnerable endpoint: GET /debugging/config/dump HTTP/1.1 on the target SkyWalking OAP server.
3. Retrieve sensitive configuration: Parse the response, which may contain database configuration details including MySQL/PostgreSQL hostnames, ports, usernames, and passwords.
4. Leverage credentials: Use the obtained database credentials to connect directly to the MySQL or PostgreSQL backend for unauthorized data access, exfiltration, or further lateral movement within the environment (GitHub Advisory, OSS-Sec).

• Network: Unexpected or anomalous HTTP GET requests to /debugging/config/dump on the SkyWalking OAP HTTP port (default 12800) from untrusted or external IP addresses.
• Logs: SkyWalking OAP access logs showing requests to /debugging/config/dump from unauthorized sources; repeated or scripted access patterns to this endpoint.
• Network: Subsequent unauthorized connection attempts to MySQL (port 3306) or PostgreSQL (port 5432) database servers from hosts that previously accessed the SkyWalking OAP debugging endpoint.

The primary remediation is to upgrade Apache SkyWalking to version 10.4.0 or later, which resolves the vulnerability (GitHub Advisory, OSS-Sec). For organizations unable to patch immediately, restrict network access to the /debugging/config/dump endpoint via firewall rules or reverse proxy access controls, limiting it to trusted internal networks or administrative hosts only. Additionally, consider rotating database credentials for MySQL and PostgreSQL instances used by SkyWalking as a precautionary measure if the endpoint was previously exposed.

The vulnerability was reported by shuiboye@gmail.com and disclosed by Apache SkyWalking maintainer Kai Wan via the oss-security mailing list on April 15, 2026 (OSS-Sec). A brief mention was noted on Bluesky (infosec.skyfleet.blue) and Mastodon (thehackerwire) shortly after disclosure, indicating routine community awareness without significant alarm given the absence of active exploitation.