CVE-2025-54057Disclosure(apache / skywalking)

Apache SkyWalking CVE-2025-54057: Stored XSS https://www.openwall.com/lists/oss-security/2026/04/13/3 CVE-2026-34476: SSRF via SW-URL Header in MCP Server https://www.openwall.com/lists/oss-security/2026/04/13/4 CVE-2026-34884: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server https://www.openwall.com/lists/oss-security/2026/04/13/5

🚨 [SECURITY FIX BYPASS] — APACHE DISCLOSES A NEW SKYwalking XSS AFTER THE PREVIOUS FIX FAILED TO FULLY CLOSE THE BUG CVE-2026-85229 affects Booster UI 10.2.0 → 10.4.0 and is explicitly described as an: INCOMPLETE FIX for an older vulnerability. CyberSignal Priority: 🟠 HIGH 🆔 CVE-2026-85229 🎯 Apache SkyWalking Booster UI 📦 Affected: 10.2.0 → 10.4.0 ✅ Fix: Horizon UI 1.0.0 🧩 Stored Cross-Site Scripting 📅 DISCLOSED: September 4, 2026 This is a security lesson that defenders see repeatedly: PATCHED does not always mean: FIXED. ### 🔎 What happened Apache disclosed CVE-2026-85229 today. The vulnerability affects: SKYWALKING BOOSTER UI and involves improper neutralization of attacker-controlled input during web-page generation. The result: STORED CROSS-SITE SCRIPTING. But the most interesting part is the vulnerability's relationship to: CVE-2025-54057. Apache describes today's flaw as: AN INCOMPLETE FIX OF THE PREVIOUS ISSUE. ### ⚔️ Attack chain Attacker-controlled content enters SkyWalking UI ↓ input is insufficiently neutralized ↓ payload stored in dashboard/widget content ↓ authorized user opens affected UI ↓ browser renders stored payload ↓ attacker-controlled JavaScript executes in trusted SkyWalking origin. Depending on the victim's session and browser context, XSS can potentially expose: session information application data authenticated actions UI manipulation. ### 🎯 What is affected Apache SkyWalking UI: 10.2.0 through 10.4.0. Apache recommends moving to: HORIZON UI 1.0.0. That version fixes the issue. ### 🔁 Why incomplete fixes matter A vulnerability fix often looks like: ATTACK INPUT ↓ SANITIZATION ADDED ↓ KNOWN PAYLOAD BLOCKED. But attackers and researchers then test: alternate encodings alternate fields alternate rendering paths alternate widgets alternate browser behavior. If the patch addressed: ONE EXPLOIT SHAPE instead of: THE ROOT TRUST BOUNDARY — the vulnerability returns. This is why patch validation matters as much as patch deployment. ### 🧠 Why this matters Observability platforms such as SkyWalking often contain: infrastructure topology service names application traces backend relationships performance data. They are frequently accessible by: developers SRE teams platform administrators. So stored browser-side attacks against monitoring platforms may run inside: HIGH-TRUST USER SESSIONS. The monitoring dashboard itself becomes: THE DELIVERY CHANNEL. ### ⚠️ Important caveat Apache does NOT currently provide evidence of: ACTIVE EXPLOITATION. There is also no CISA KEV entry identified in the current records. And the upstream CNA has not assigned a standard CVSS base score in the disclosure reviewed here. Therefore: DO NOT invent a severity score. The accurate description is: NEWLY DISCLOSED STORED XSS / INCOMPLETE SECURITY FIX. ### 🛡️ Defender action Organizations using SkyWalking should: → identify Booster UI 10.2.0–10.4.0 → migrate to Horizon UI 1.0.0 → inspect dashboard/widget content for unexpected markup → review privileged UI sessions → apply restrictive Content Security Policy where possible → avoid treating output encoding as the only defense → test the original CVE and bypass variants after upgrading. Security teams should always verify: PATCH INSTALLED and: ORIGINAL EXPLOIT + VARIANTS NO LONGER WORK. Those are not the same check. ### 🧠 CyberSignal insight The most dangerous phrase in vulnerability management may be: “WE ALREADY PATCHED THAT.” An incomplete fix gives defenders confidence— while leaving attackers: A DIFFERENT PATH THROUGH THE SAME DOOR. Sources: Apache Software Foundation · oss-security · CVE Program