CVE-2026-82265

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-822669.8Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated reques CVE-2026-822675.4Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute an CVE-2026-822687.5Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied path CVE-2026-822698.1Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers wit CVE-2026-82278.8A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manip CVE-2026-822707.5Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator CVE-2026-822716.5R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to mod CVE-2026-822726.5Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing th CVE-2026-822736.5Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId CVE-2026-822744.7Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats t CVE-2026-822757.5Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended dire CVE-2026-822765.3StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly inste