CVE-2026-34884
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.
Risk Assessment
The organization may be exposed to unauthorized requests to internal resources (SSRF) and manipulation of GraphQL queries, potentially leading to data leakage or system integrity compromise.
Recommendation
It is recommended to upgrade Apache SkyWalking MCP to version 0.2.0.
Original NVD description (English source)
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.