{"id":"EUVD-2026-21918","enisaUuid":"6f7d3a43-9ffe-324d-bebd-d239a8eb3c9c","description":"Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.\n\nThis issue affects Apache SkyWalking MCP: 0.1.0.\n\nUsers are recommended to upgrade to version 0.2.0, which fixes this issue.","datePublished":"Apr 13, 2026, 1:01:31 PM","dateUpdated":"Apr 13, 2026, 3:29:57 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://lists.apache.org/thread/v0k1xyzzbtnpyrwxwyn36pbspr8rhjnr\n","aliases":"CVE-2026-34476\nGHSA-c4hg-6933-x62x\n","assigner":"apache","epss":0.48,"enisaIdProduct":[{"id":"e8dfccde-272a-3d66-bc7c-1871a0fd4c70","product":{"name":"Apache SkyWalking MCP","vendor":{"name":"Apache Software Foundation"}},"product_version":"0.1.0"}],"enisaIdVendor":[{"id":"d98e7ba8-c281-309d-9c91-ae388f298f81","vendor":{"name":"Apache Software Foundation"}}],"enisaIdVulnerability":[{"id":"213bdd0f-57d1-379f-a1ce-125d15be4588","vulnerability":{"id":"CVE-2026-34476","description":"Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.\n\nThis issue affects Apache SkyWalking MCP: 0.1.0.\n\nUsers are recommended to upgrade to version 0.2.0, which fixes this issue.","datePublished":"Apr 13, 2026, 1:01:31 PM","dateUpdated":"Apr 13, 2026, 3:29:57 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://lists.apache.org/thread/v0k1xyzzbtnpyrwxwyn36pbspr8rhjnr\n","enisa_id":"EUVD-2026-21918\n","assigner":"apache","epss":0.48,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"440f1479-e181-3e6c-9612-70be0dc93812","product":{"name":"Apache SkyWalking MCP","vendor":{"name":"Apache Software Foundation"}},"product_version":"0.1.0"}],"vulnerabilityVendor":[{"id":"30d865ac-364e-3517-9efd-5a4647cd6142","vendor":{"name":"Apache Software Foundation"}}]}},{"id":"a96475fb-b929-36ca-829c-e6278f411570","vulnerability":{"id":"GHSA-c4hg-6933-x62x","description":"Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server","datePublished":"Apr 13, 2026, 3:31:41 PM","dateUpdated":"Jul 21, 2026, 1:56:29 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-34476\nhttps://github.com/advisories/GHSA-c4hg-6933-x62x\nhttps://github.com/apache/skywalking-mcp\nhttps://lists.apache.org/thread/v0k1xyzzbtnpyrwxwyn36pbspr8rhjnr\nhttp://www.openwall.com/lists/oss-security/2026/04/13/4\n","enisa_id":"EUVD-2026-21918\n","aliases":"GHSA-c4hg-6933-x62x\nCVE-2026-34476\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}