Severity by source
Authenticated readonly user (PR:L) over the network (AV:N); non-default experimental config raises AC:H; impact is a limited integrity bypass (I:L) with no confidentiality or availability effect.
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 3
AnalysisAI
Improper authorization in Apache SkyWalking BanyanDB 0.11.0 lets a Canopy user holding only readonly privileges forward non-read requests through the /monitoring/* proxy, because Canopy does not enforce readonly-role restrictions on that proxy path. The attack is network-reachable but constrained: it requires an explicitly non-default deployment in which the operator has enabled Canopy's incomplete proof-of-concept monitoring-proxy functionality, provisioned a readonly Canopy account, and exposed a reachable monitoring target, and the attacker must already possess valid readonly credentials (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific NON-DEFAULT deployment: the operator must have enabled Canopy's proof-of-concept monitoring-proxy functionality, provisioned a readonly Canopy user, AND have a reachable monitoring target behind the /monitoring/* proxy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue and the signals that exist all point the same way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache SkyWalking BanyanDB to version 0.11.1, the vendor-released fix for CVE-2026-85499, which enforces readonly-role restrictions on the Canopy /monitoring/* proxy; there is no backport listed for the 0.11.0 line, so moving to 0.11.1 is the primary action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any BanyanDB 0.11.0 deployment has Canopy's experimental monitoring-proxy functionality enabled and whether readonly Canopy accounts exist; where it is enabled without an operational requirement, disable the monitoring proxy and revoke or restrict unused readonly Canopy accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today