CVE-2026-30778

CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

Vendor Apache Software Foundation

Product Apache SkyWalking

Weakness CWE-202

Published April 15, 2026

Last update April 16, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

Key dates

02Disclosure timeline

April 15, 2026 CVE published

April 16, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-30778 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/202.html

Related vulnerabilities

04Related CVE

CVE-2026-3546 e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action CVE-2023-7072 Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint CVE-2024-13255 RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 CVE-2024-2088 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure CVE-2022-41623 WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerability