CVE-2026-85499Critical· 9.1▾ MidnightImproper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
— → 9.1
none → critical
0.2% → 0.3%
Improper Authorization vulnerability in Apache SkyWalking BanyanDB.
The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy.
This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111812Critical· 10.0Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
CVE-2026-105942High· 7.7Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
CVE-2026-105938Low· 2.3Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
CVE-2026-105930Medium· 6.0Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
CVE-2026-105927Low· 2.3Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
CVE-2026-110985NoneApache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured