Apache Skywalking vulnerabilities

4 CVEs affecting Apache Skywalking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-30778, published 2026-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-9483, published 2020-06-30. High severity, CVSS 7.5. EPSS: 34.6% chance of exploitation in the next 30 days. **Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache…
CVE-2020-13921, published 2020-08-05. Critical severity, CVSS 9.8. EPSS: 33.5% chance of exploitation in the next 30 days. **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVE-2025-54057, published 2025-11-27. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade…
CVE-2026-30778, published 2026-04-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are…