Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-34884 EUVD-2026-60572GHSA-fvf9-f2mx-m7qp

Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server

Published Aug 18, 2026 · Updated Aug 19, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache SkyWalking MCP

Description

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.

This issue affects Apache SkyWalking MCP: 0.1.0.

Users are recommended to upgrade to version 0.2.0, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache SkyWalking MCP 0.1.0 —

References