CVE-2026-82265: Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-24
Weakness: CWE-306

Description

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

Affected products

openzipkin zipkin: through 3.6.1

References

https://github.com/openzipkin/zipkin
https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml
https://github.com/openzipkin/zipkin/issues/3835
https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure

Get alerted when CVE-2026-82265 or the next vulnerability affects your stack