IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-04-13 13:16

MODIFIED

2026-04-13 13:16

EPSS (Prob. Exploit)

0.54%

Top 55.3%

DATA SOURCES:

NVD 🔗 2026-04-13 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-918

> CWE DETAILED DESCRIPTIONS

CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

> GITHUB SECURITY ADVISORY

GHSA-c4hg-6933-x62x HIGH

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

AFFECTED PACKAGES:

GO / github.com/apache/skywalking-mcp

< 0.2.0

Fixed in: 0.2.0

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/04/2026 13:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/05/2026 06:01

CWE