CVE-2026-34476 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
An attacker can exploit a Server-Side Request Forgery vulnerability in Apache SkyWalking MCP via the SW-URL header to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34476?
CVE-2026-34476 is a high-severity server-side request forgery vulnerability in Apache SkyWalking MCP, published on 13 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.
This issue affects Apache SkyWalking MCP: 0.1.0.
Users are recommended to upgrade to version 0.2.0, which fixes this issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-34476?
3 open source packages ship an affected version, including github.com/apache/skywalking-mcp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apache/skywalking-mcp Go | All versions | 0.2.0 |
github.com/apache/skywalking-mcp Go | All versions | 0.2.0 |
github.com/apache/skywalking-mcp Go | All versions | 0.2.0 |
Products include Apache Skywalking Mcp.
How do I fix CVE-2026-34476?
Upgrade github.com/apache/skywalking-mcp to 0.2.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-34476 being exploited?
There is no known exploitation of CVE-2026-34476 in the wild and no public exploit code.
Other vulnerabilities in Apache SkyWalking MCP
Sources
Also known as GHSA-c4hg-6933-x62x, GO-2026-5310.