CVE-2026-85499

9.1 Critique

Publiée le 12/10/2026 à 14:17 · Modifiée le 16/10/2026 à 20:19 · Analyse NVD reportée · Source : security@apache.org

Description

Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy. This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache SkyWalking BanyanDB

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-863

Références

https://lists.apache.org/thread.html/qz1ogm6b37gfqq04y0lkdj8x1zr5cb4r
http://www.openwall.com/lists/oss-security/2026/09/28/5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories