apache/skywalking

apache/skywalking

skywalking.apache.org

Releases69

Frequency1 month 3 weeks

Last Release4 months ago

Stars24.9K

APM, Application Performance Monitoring System

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-30778NVD↗	>= 9.7.0, < 10.4.0	Apr 15, 2026Wednesday, 15 April 2026, 11:16	7.5 HIGH	—
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.
CVE-2025-54057NVD↗	< 10.3.0	Nov 27, 2025Thursday, 27 November 2025, 12:15	6.1 MEDIUM	—
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.
CVE-2022-36127NVD↗	= *	Jul 18, 2022Monday, 18 July 2022, 12:15	7.5 HIGH	—
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
CVE-2020-13921NVD↗	= 7.0.0, = 6.5.0, = 6.6.0, = 8.0.0, = 8.0.1, all versions	Aug 5, 2020Wednesday, 5 August 2020, 14:15	9.8 CRITICAL	7.5 HIGH
Resolved Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVE-2020-9483NVD↗	= 7.0.0, >= 6.0.0, <= 6.6.0	Jun 30, 2020Tuesday, 30 June 2020, 15:15	7.5 HIGH	5 MEDIUM
Resolved When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.