CVE-2026-82265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82265", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-28T11:12:36.688Z", "datePublished": "2026-08-28T16:18:50.031Z", "dateUpdated": "2026-09-24T14:19:56.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:56.693Z"}, "datePublic": "2026-07-01T00:00:00.000Z", "title": "Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure", "descriptions": [{"lang": "en", "value": "Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "openzipkin", "product": "zipkin", "versions": [{"version": "0", "lessThanOrEqual": "3.6.1", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/openzipkin/zipkin/issues/3835", "tags": ["issue-tracking"], "name": "GitHub Issue #3835"}, {"url": "https://github.com/openzipkin/zipkin", "tags": ["product"]}, {"url": "https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml", "tags": ["technical-description"], "name": "Vulnerable code: zipkin-server-shared.yml"}, {"name": "VulnCheck Advisory: Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T18:43:06.150767Z", "id": "CVE-2026-82265", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T18:43:27.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82265", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T18:43:06.150767Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T18:43:12.504Z"}}], "cna": {"title": "Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openzipkin", "product": "zipkin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-01T00:00:00.000Z", "references": [{"url": "https://github.com/openzipkin/zipkin/issues/3835", "name": "GitHub Issue #3835", "tags": ["issue-tracking"]}, {"url": "https://github.com/openzipkin/zipkin", "tags": ["product"]}, {"url": "https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml", "name": "Vulnerable code: zipkin-server-shared.yml", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure", "name": "VulnCheck Advisory: Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:56.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82265", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:19:56.693Z", "dateReserved": "2026-08-28T11:12:36.688Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-28T16:18:50.031Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "zipkin", "vendor": "openzipkin", "versions": [{"lessThanOrEqual": "3.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging."}], "id": "CVE-2026-82265", "lastModified": "2026-09-24T20:28:01.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82265", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T18:43:06.150767Z", "version": "2.0.3"}}]}, "published": "2026-08-28T20:20:17.070", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/openzipkin/zipkin"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openzipkin/zipkin/issues/3835"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zipkin: org.springframework.boot/spring-boot-actuator: Zipkin: Information disclosure via unauthenticated Spring Boot Actuator endpoints", "id": "2525690", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525690"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-306", "details": ["Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.", "A flaw was found in Zipkin. Unauthenticated attackers can exploit exposed Spring Boot Actuator endpoints on the tracing API port to access sensitive information. This allows them to read environment variables, bean configurations, and storage credentials. Additionally, attackers can modify log levels, potentially suppressing important logging information."], "mitigation": {"lang": "en:us", "value": "Restrict access to Spring Boot Actuator endpoints by configuring explicit web security authentication rules, or isolate the management port from public exposure by setting `management.server.port` to a dedicated internal network interface."}, "name": "CVE-2026-82265", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "spring-boot-actuator", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-28T16:18:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-82265\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82265\nhttps://github.com/openzipkin/zipkin\nhttps://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml\nhttps://github.com/openzipkin/zipkin/issues/3835\nhttps://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure"], "statement": "An unauthorized access flaw was found in Zipkin. The application exposes Spring Boot Actuator management endpoints directly on the tracing API network port without enforcing authentication or access controls. An unauthenticated remote attacker can exploit these endpoints to extract sensitive runtime configuration details, including environment variables, bean definitions, and storage credentials, or modify log levels to suppress security auditing.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.6.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zipkin", "source": "cna", "vendor": "openzipkin"}, "product": "zipkin", "vendor": "openzipkin"}], "created": "2026-08-28T22:30:17.717215+00:00", "updated": "2026-08-31T11:20:42.378129+00:00", "vendors": ["openzipkin", "openzipkin$PRODUCT$zipkin"]}