SSRF in Apache Software Foundation Skywalking Mcp
CVE-2026-34884
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.
Vulnerability class: SSRF (Server-Side Request Forgery)
Affected products
- Apache Software Foundation Skywalking Mcp — versions 0.1.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108