What is the CVSS score of CVE-2026-34884?

CVE-2026-34884 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache SkyWalking MCP are affected by CVE-2026-34884?

Apache SkyWalking MCP Server 0.1.0 contains critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote attackers to access internal infrastructure and manipulate observability systems.

How to fix or mitigate CVE-2026-34884?

Within 24 hours, conduct asset discovery to identify all Apache SkyWalking MCP Server 0.1.0 instances across production and non-production environments and assess network exposure to untrusted sources. Within 7 days, implement firewall rules restricting the MCP server to explicitly authorized internal clients only, deploy Web Application Firewall rules blocking requests to the set_skywalking_url and GraphQL query injection endpoints, and disable these vulnerable tools if business operations permit. Within 30 days, engage the Apache SkyWalking project for patch availability timeline, evaluate migration to patched versions or alternative observability platforms, and establish continuous monitoring for unauthorized MCP server access attempts and exploitation indicators.

Apache SkyWalking MCP CVE-2026-34884

EUVD-2026-60572 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-24

GHSA-fvf9-f2mx-m7qp

XSS Apache SSRF Skywalking Mcp

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.4 CRITICAL

Remote unauthenticated tool access enables SSRF and GraphQL injection (AV:N/AC:L/PR:N), yielding high confidentiality and integrity impact; availability impact is limited, so A:L rather than A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 16:46 vuln.today

CVSS changed

Aug 19, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

Apr 24, 2026 - 12:21 oss-security

CRITICAL 9.8

CVE Published

Apr 24, 2026 - 12:21 nvd

N/A

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Server-Side Request Forgery and GraphQL expression injection in Apache SkyWalking MCP Server 0.1.0 allow remote attackers to coerce the server into issuing arbitrary requests via the set_skywalking_url tool and to inject attacker-controlled expressions into backend GraphQL queries. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an unauthenticated network attacker can reach internal services and manipulate observability queries. No public exploit was identified at time of analysis, and the EPSS probability is low (0.24%, 15th percentile), consistent with a newly disclosed, niche component.

Technical ContextAI

Apache SkyWalking is a widely used open-source APM and observability platform; the affected component is its experimental MCP (Model Context Protocol) Server, which exposes SkyWalking data and controls as tools consumable by AI agents. CWE-918 (SSRF) is the root cause: the set_skywalking_url tool lets a caller redefine the backend URL the MCP server contacts, so the server can be pointed at internal or cloud-metadata endpoints it should never reach. The second flaw is expression/injection within SkyWalking's GraphQL query interface, where unsanitized input is embedded into query expressions, letting an attacker alter query logic and pull data beyond intended scope. Only version 0.1.0 is enumerated, reflecting a very early release of this add-on.

RemediationAI

Consult the Apache advisory thread (https://lists.apache.org/thread/s447p6h5dfr02lx17v27phoksgb8mkkp) for the fixed release; a released patched version is not independently confirmed from the available data, so upgrade to the vendor-designated fixed build once identified. As compensating controls until patched: restrict who can invoke the set_skywalking_url tool or disable that tool entirely (trade-off: loses runtime reconfiguration of the target URL); enforce an allowlist of permitted backend SkyWalking URLs and block the MCP server's outbound access to internal ranges and cloud metadata endpoints such as 169.254.169.254 (trade-off: may break legitimate internal targets that must be explicitly allowlisted); place network authentication and source-IP restrictions in front of the MCP server so it is not exposed to untrusted callers; and validate/parameterize input to the GraphQL layer to blunt expression injection. Also review the oss-security post (https://www.openwall.com/lists/oss-security/2026/04/13) for coordinated fixes to related SkyWalking CVEs disclosed the same day.