CVE-2026-82265: Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure
Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zipkinto a version that resolves this vulnerability.Fixed in 3.6.1 - Configuration
Enable/require authentication for Spring Boot Actuator endpoints exposed on the tracing API port to prevent unauthenticated access to environment variables, bean configurations, and storage credentials
Spring Boot Actuator (Zipkin) Authentication for Actuator endpoints = required - Configuration
Prevent attackers from modifying log levels via exposed endpoints so logging cannot be suppressed
Logging (Zipkin / Spring Boot) Actuator/logging level modification = disable or restrict - Compensating control
Restrict access to the tracing API port / Spring Boot Actuator endpoints so they are not reachable without authentication (e.g., enforce network/firewall/ingress controls for actuator endpoints)
Event History
Frequently Asked Questions
Which Zipkin versions are potentially affected?
Zipkin versions through 3.6.1 are affected according to the available information.
What can an unauthenticated attacker access or change?
An attacker can use Actuator endpoints on the tracing API port to read environment variables, bean configurations, and storage credentials. They can also modify log levels, potentially suppressing logging.