CVE-2026-82265mediumCWE-306

Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%

exploitation probability

0.4%top 64% of all CVEs

observed exploitation

nono source reports it

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

openzipkin · zipkin

References

https://github.com/openzipkin/zipkin https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml https://github.com/openzipkin/zipkin/issues/3835 https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure