External risk intelligence

Apache SkyWalking BanyanDB Improper Authorization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-85499

The vulnerability involves a non-default configuration of a monitoring-proxy functionality within BanyanDB, which is typically an internal backend database component. While network-reachable, it is not a standard internet-facing service, and exploitation requires specific, non-default settings, making public internet exposure uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Apache SkyWalking BanyanDB, specifically concerning improper authorization within its monitoring proxy functionality. While typically an internal component, a non-default configuration could allow unauthorized actions if a read-only user can access a reachable monitoring target. The primary concern is confirming if this specific, non-default configuration exists within our environment.

Unauthorized actions possible through a monitoring proxy.
Non-default configuration required for exploitation.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending unauthorized requests through a monitoring proxy. This requires a specific, non-default configuration where a read-only user can access this proxy, which then forwards requests to a monitoring target. Successful exploitation could allow an attacker to perform actions beyond their intended permissions.

Requires a non-default configuration.
Attacker sends non-read requests.
Leads to unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

When configured with a read-only user and a reachable monitoring target, this improper authorization vulnerability could allow that user to send non-read requests through the monitoring proxy, potentially impacting service behavior.

Monitoring proxy data could be affected.
Non-read requests could be sent through proxy.
Service behavior could be altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Improper Authorization vulnerability in Apache SkyWalking BanyanDB impacts teams managing internal observability platforms and potentially those responsible for configuration management. The first action should be to identify all instances of BanyanDB, determine if they are configured with the vulnerable monitoring-proxy functionality and reachable by unauthenticated users, and then confirm the specific owner for remediation planning.

Platform or application owners.
Verify monitoring-proxy reachability and configuration.
Plan upgrade during a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache SkyWalking BanyanDB?

BanyanDB is an observability database designed for Apache SkyWalking, an application performance monitoring system. It serves as a storage and query backend for trace, metric, and log data. Organizations use it to handle large-scale observability data, typically running it as an internal component within their infrastructure to support performance analysis and system monitoring tasks.

What does improper authorization mean for CVE-2026-85499?

This vulnerability, classified as CWE-863, occurs when an application fails to properly verify if a user has permission to perform a specific action. In this case, the system mistakenly allows a user restricted to read-only access to execute non-read requests. The flaw exists within the monitoring-proxy functionality, effectively bypassing the access controls intended to protect the system from unauthorized command execution.

How can an attacker trigger this vulnerability?

An attacker must leverage a specific, non-default configuration where the monitoring-proxy is active and a read-only account is present. The attacker uses this account to route unauthorized requests to a reachable monitoring target through the proxy. Standard, default installations where this proxy functionality remains disabled or unused do not trigger the bug, as the pathway for forwarding these non-read requests is not established.

Is my BanyanDB instance at risk?

According to Halo Surface Signal, this is unlikely for most users. The affected monitoring-proxy is an internal backend component, not a service typically exposed to the public internet. Because the vulnerability requires a non-standard configuration involving specific proxy settings, most environments are not immediately reachable by external actors. You should verify your internal configuration to confirm if the proxy feature is enabled.

What should I do to address CVE-2026-85499?

The primary response is to upgrade your BanyanDB instance to version 0.11.1 or later, which resolves the authorization flaw. Before upgrading, identify all running instances to determine if they utilize the monitoring-proxy feature. If the feature is active, prioritize these systems for an update during your next maintenance window to ensure proper access controls are restored.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.