Skip to content
OpenAdvisories

Vendor

Open Zipkin

2 known vulnerabilities.

Products

zipkin 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-82265

    Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

    Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credenti…

    Open Zipkin zipkin
  • Medium 5.3
    CVE-2025-53602

    Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

    Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.

    Open Zipkin zipkin io.zipkin:zipkin-server Maven