VulnSocial

CVE-2026-34476Disclosure(apache / skywalking_mcp)

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache skywalking_mcp systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • skywalking_mcp

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
skywalking_mcp

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-13: 2Patch / Workaround · 2026-04-13: 1Technical Details · 2026-04-13: 204-13
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets4 URLs
Full discourse2 posts
  • Open Source Security mailing list@oss_security
    General

    Apache SkyWalking CVE-2025-54057: Stored XSS https://www.openwall.com/lists/oss-security/2026/04/13/3 CVE-2026-34476: SSRF via SW-URL Header in MCP Server https://www.openwall.com/lists/oss-security/2026/04/13/4 CVE-2026-34884: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server https://www.openwall.com/lists/oss-security/2026/04/13/5

    Post summary

    The post lists three Apache SkyWalking CVEs with concise vulnerability descriptions and links to mailing‑list discussions, but provides no PoC, exploit, active attack, or mitigation details.

    00030437
    4.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34476 Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgr… https://www.cve.org/CVERecord?id=CVE-2026-34476

    Post summary

    A new Server‑Side Request Forgery vulnerability (CVE‑2026‑34476) in Apache SkyWalking MCP 0.1.0 has been disclosed, with users advised to upgrade as a mitigation.

    00000106
    57.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheskywalking_mcp---

Explore more

Back to dashboardapache CVEsskywalking_mcp vulnerabilities