CVE-2026-34884

CRITICAL 9.8

Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server

CVSS Score

9.8

EPSS Score

0.2%

EPSS Percentile

15th

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.

CWE	CWE-918
Vendor	apache software foundation
Product	apache skywalking mcp
Published	Aug 18, 2026
Last Updated	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache skywalking mcp

Be the first to know when new critical vulnerabilities affecting apache software foundation apache skywalking mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache SkyWalking MCP

0.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/s447p6h5dfr02lx17v27phoksgb8mkkp openwall.com: http://www.openwall.com/lists/oss-security/2026/04/13/5

Credits

🔍 Andrea Cosentino <[email protected]>