Zipkin CVE-2026-82265

Spring Boot Actuator endpoints must be enabled and accessible on the Zipkin tracing API port - the referenced default configuration in zipkin-server-shared.yml indicates this is the default deployment posture, not a non-default opt-in. The attacker requires TCP network access to the Zipkin API port (typically 9411); no authentication, credentials, or pre-existing session are required (CVSS PR:N). Exploitation is limited by: network segmentation or firewall rules that restrict access to port 9411 to trusted clients; a non-default configuration that binds actuator endpoints to a separate restricted management port or disables them entirely; or a reverse proxy or API gateway placed in front of Zipkin that blocks requests to /actuator paths. Deployments where Zipkin is exposed to the public internet or to broad internal network segments with no such controls are fully exploitable without any user interaction.

The CVSS 4.0 base score of 6.9 reflects AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:N. The network attack vector with no authentication or complexity barriers makes exploitation trivial for any attacker with port access. The direct impact on the Zipkin system is rated low for both confidentiality and integrity, but this underrepresents real-world risk: credential exfiltration via /actuator/env can enable lateral movement to storage backends holding all traced application traffic, potentially elevating the effective confidentiality impact significantly. The integrity signal (VI:L) captures the ability to modify log levels, which attackers can exploit to blind monitoring and SIEM pipelines before conducting follow-on attacks. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed. The absence of a POC in references does not reduce risk given that exploitation requires only standard HTTP GET and POST requests to well-documented Spring Boot Actuator paths. Risk is highest in deployments where the Zipkin API port is accessible from untrusted networks or shared internal segments without network-layer access controls.

An attacker with network access to the Zipkin tracing API port issues an unauthenticated HTTP GET request to /actuator/env, receiving a JSON response containing all Spring Environment properties including database credentials, API keys, and storage backend connection strings configured for Zipkin. Using those credentials, the attacker authenticates directly to the backing storage system (e.g., Cassandra or Elasticsearch) to exfiltrate distributed trace data from instrumented applications. In a parallel or preparatory step, the attacker issues a POST to /actuator/loggers to set log levels to OFF, suppressing Zipkin's own audit trail before conducting further reconnaissance.