EUVD-2026-70923
GHSA-f684-fh59-2gh3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
MITM network position required raises AC:H; routing key fully exposed in cleartext sets C:H; stolen key enables false event injection yielding I:L; no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Apache SkyWalking's PagerDuty alarm hook in versions 9.6.0 through 10.x transmits the PagerDuty integration routing key inside an unencrypted HTTP POST body before any redirect response from PagerDuty's HTTPS-only endpoint is received. Because the initial TCP socket write occurs in plaintext prior to the 301/302 redirect, a passive eavesdropper or MITM attacker positioned between the SkyWalking host and PagerDuty's API can capture the routing key verbatim from network traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must be simultaneously true for exploitation: (1) The PagerDuty alarm hook must be explicitly configured in SkyWalking with a valid routing key - this is an optional integration that is disabled by default and requires deliberate administrator setup; if no PagerDuty hook is configured, the vulnerability is not reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Rated 'low' severity in the advisory, consistent with a high-complexity, narrowly-scoped credential exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache SkyWalking to version 11.0.0, which resolves the cleartext transmission by enforcing HTTPS for the initial PagerDuty API POST. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SkyWalking instances running versions 9.6.0 through 10.x and confirm which are configured with PagerDuty integration, documenting the scope and routing keys in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today