External risk intelligence

Apache SkyWalking MCP SSRF and GraphQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34884

Apache SkyWalking MCP acts as a Mesh Control Plane, which is typically deployed as a centralized management service or gateway for observability data. These services are commonly accessible over the network to receive telemetry and provide management interfaces, making them frequent candidates for internet-facing or edge-adjacent deployment in service mesh architectures.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Apache SkyWalking MCP, a technology used for managing observability data in service mesh environments. This issue could allow unauthorized access and manipulation of the system, potentially impacting the integrity and availability of critical data.

Core function compromised by external input.
Centralized management service may be at risk.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the Apache SkyWalking MCP. The system's reliance on user-supplied input for its `set_skywalking_url` tool and its handling of GraphQL expressions create an opening. Successful exploitation could allow an attacker to execute arbitrary code, compromise data integrity, and disrupt service availability.

No authentication required for entry.
Triggered by GraphQL expression injection.
Risk of code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

The SSRF vulnerability in Apache SkyWalking MCP, when combined with GraphQL expression injection, could allow an unauthenticated attacker to redirect network requests to arbitrary internal or external resources and potentially execute arbitrary code by injecting malicious GraphQL expressions. This could affect the integrity and availability of the SkyWalking control plane and any connected services.

Affected asset: Apache SkyWalking MCP.
Exposure: Network-accessible SSRF and injection.
Consequence: Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Apache SkyWalking MCP, likely platform or observability teams, should initiate by identifying all deployments and assessing their network exposure and criticality. Understanding which systems are reachable and host business-critical functions will inform the necessary remediation urgency and ownership. Coordination with the vendor for an upgrade plan, or implementing temporary risk reduction measures, should follow this initial assessment.

Platform/Observability teams own the issue.
Verify network exposure and business criticality.
Plan upgrade or implement temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache SkyWalking MCP used for?

Apache SkyWalking MCP serves as a Mesh Control Plane. It functions as a centralized management service designed to collect, process, and manage observability data within service mesh architectures. By providing a unified interface for telemetry, it helps engineers monitor the health, performance, and communication patterns of distributed applications.

How do the CVE-2026-34884 vulnerabilities work?

This issue combines two weaknesses. First, an SSRF flaw allows unauthorized redirection of network requests to unintended targets. Second, the system is susceptible to GraphQL expression injection. Together, these allow an attacker to bypass standard controls, injecting malicious instructions into the system that can lead to data compromise or unauthorized code execution.

Does any specific action trigger this vulnerability?

The vulnerability is triggered by sending specially crafted, unauthenticated requests to the MCP. Because the system improperly trusts input provided to the set_skywalking_url tool and its GraphQL interface, it processes the malicious data directly. It is important to note that the vulnerability is not triggered by standard, legitimate telemetry traffic; it specifically requires the submission of crafted, malicious input designed to manipulate internal processing.

Why does Halo Surface Signal categorize this as high risk?

Halo Surface Signal identifies this as a significant concern because Apache SkyWalking MCP is often deployed as a gateway or central management service. Since these components frequently reside in network-accessible locations to receive observability data from throughout an environment, they are often exposed to broader network segments, making them prime targets for external attackers.

How should I respond to this vulnerability?

Begin by identifying all instances of Apache SkyWalking MCP currently running in your environment. Prioritize deployments based on their network accessibility and the criticality of the services they monitor. Once identified, coordinate with your team to plan an upgrade to version 0.2.0, which contains the necessary fixes. If an immediate upgrade is not possible, evaluate if you can restrict network access to these services to reduce the attack surface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.