SB2026090444 - Multiple vulnerabilities in Apache SkyWalking

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-71216)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose the PagerDuty integration routing key.

The vulnerability exists due to cleartext transmission of sensitive information in the PagerDuty alarm hook when sending alarm notifications over HTTP. A remote attacker can intercept the unencrypted initial POST request to disclose the PagerDuty integration routing key.

The initial POST is transmitted before an HTTP redirect response is received.

2) Cross-site scripting (CVE-ID: CVE-2026-85229)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in Apache SkyWalking Booster UI dashboard widgets when rendering dashboard widgets. A remote attacker can store crafted script content in dashboard widgets to execute arbitrary script in a victim's browser.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=v0bqvrqosqm6gc43o63jgzps1qzcjk5l
• https://lists.apache.org/api/email.lua?id=byj0zyogy2nyo28rg36bk18f8fnffknv
• https://skywalking.apache.org/