CVE-2026-34476

OVERVIEW CVE-2026-34476 is a Server-Side Request Forgery (SSRF) vulnerability in Apache SkyWalking MCP version 0.1.0, exploitable through the SW-URL header. This flaw allows an attacker to manipulate the application into making unintended requests to internal or external systems, potentially exposing sensitive resources. SEVERITY The vulnerability carries a HIGH CVSS score of 7.1, with a network-based attack vector requiring low complexity and low privileges to exploit. The attack does not require user interaction and could result in high confidentiality impact and low integrity impact, though availability remains unaffected. The EPSS score of 0.00079 indicates this is not yet a widespread target in the wild. EXPLOITATION STATUS There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is marked as inactive on threat intelligence lists and does not appear in known exploitation tracking databases. However, users running version 0.1.0 should prioritize upgrading to version 0.2.0 to remediate this risk before potential weaponization.