Apache SkyWalking MCP: CVE-2026-34884 combines SSRF with GraphQL injection
SkyWalking MCP 0.1.0 allowed a tool to change its backend URL and manipulate GraphQL. We analyse MCP boundaries, exposure and the 0.2.0 upgrade.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 18 August 2026
- READING TIME
- 15 min read
- TOPIC
- AI Security
The CVE-2026-34884 record published on 18 August 2026 describes a critical issue in Apache SkyWalking MCP 0.1.0. Through the set_skywalking_url tool, the MCP server allowed control over its backend destination, creating an SSRF path, while its construction of GraphQL expressions enabled injection. The project recommends moving to version 0.2.0.
Chronology matters. Apache’s security-list announcement dates to 13 April, while the CVE record was published or updated for broad indexing on 18 August. This is not a newly discovered attack that occurred that day. It is a newly visible record for a problem disclosed and repaired earlier. Teams should still avoid assuming an April fix automatically reached every image, experiment and developer installation.
What SkyWalking MCP does
Apache SkyWalking is an observability platform for distributed systems. Its MCP server gives an agent or assistant tools to query SkyWalking data. A user can ask in natural language for analysis of services, traces or metrics. Underneath, the server translates the intent into backend calls.
That integration joins three trust zones: untrusted content processed by the model, the MCP process executing tools, and an observability system containing infrastructure intelligence. If the agent can change the destination or freely shape a query, model input begins to influence network routing and query language structure.
“It only reads metrics” is therefore the wrong risk model. Even without an operating-system command, an operation can scan an internal network, touch a cloud metadata endpoint or manipulate a query sent with the server’s privileges.
SSRF through backend URL control
Server-Side Request Forgery occurs when an attacker controls where a server sends a request. Here, a tool could set the SkyWalking URL. If the model invokes it in response to a direct instruction or prompt injection inside processed content, the MCP process may connect to a destination selected by the attacker.
Impact depends on the process’s network and identity. Targets may include services reachable only locally, an administrative panel, loopback, RFC1918 space, IPv6 link-local addresses, internal DNS or a cloud metadata service. Even where the response is not returned directly, timing and error differences can support enumeration.
Blocking textual prefixes is insufficient. A destination can pass through redirects, alternative IP notation, attacker-controlled DNS or a result changed between validation and connection. A secure implementation assigns the backend administratively, resolves DNS in a controlled way, checks the final address after every redirect, and enforces a scheme, host and port allowlist.
The strongest control remains the network. An MCP process should have no route to metadata, control-plane or unrelated segments. Egress policy ensures an application-validation bug does not automatically provide infrastructure-wide reach.
GraphQL expression injection
The second part of the CVE concerns GraphQL expression injection. If tool-controlled values are concatenated into a query string, an attacker can attempt to close an expected argument and add fields, fragments or directives. This is not conventional SQL injection, but the shared failure is the same: data becomes programme structure.
GraphQL’s schema and type validation do not prevent a query that is syntactically valid but broader than the wrapper intended. A process may retrieve additional fields, trigger costly nesting or use a mutation if its credential and the schema permit it. Actual impact therefore depends on available operations and the SkyWalking token’s permissions.
A safe client uses static GraphQL documents and passes variables separately with constrained type and length. A server can allowlist operations or persisted queries, limit depth and complexity, impose timeouts and cap results. The integration account should have only the necessary read access.
How prompt injection reaches the network layer
An attack need not begin with an administrator deliberately entering a malicious URL. An agent may analyse a log, ticket, incident description or web page containing a hidden instruction. If the model treats it as a command and can invoke set_skywalking_url, untrusted content crosses from language into transport configuration.
This is the core MCP security problem: a tool schema defines format, not policy. A syntactically valid string may name a prohibited host. A valid expression may violate user intent. A broker needs to separate the model’s decision from operation approval and prohibit critical configuration changes in a routine read session.
An AI agent sandbox architecture should include a separate process or microVM for a connector, per-tool network policy and no inherited secrets. If every connector shares one process, egress profile and credential set, compromise of the weakest integration spreads to the others.
A separate SW-URL vulnerability
SkyWalking MCP 0.1.0 was also affected by CVE-2026-34476, described as SSRF through the SW-URL header. Upgrading to 0.2.0 addresses both, but the identifiers and mechanics should not be collapsed. CVE-2026-34884 joins the URL-setting tool with GraphQL injection; CVE-2026-34476 concerns another input that controls the destination.
The distinction matters defensively. Disabling one tool is not enough if an alternative header can still change the host. Regression tests should cover every point where a backend destination may originate in a request, session configuration, header or environment variable.
Assessing exposure
Start with the SBOM, lockfile, image and running process. A repository name in documentation does not prove what version a cluster executes. Find SkyWalking MCP 0.1.0 in production, staging, demos, developer laptops and private agents. Determine whether the process could set a destination, reach internal networks and use a SkyWalking credential.
Then:
- upgrade to 0.2.0 or a later supported release and rebuild pinned-digest images;
- remove model-controlled backend changes where there is no business need;
- restrict DNS, egress and redirects to the approved SkyWalking cluster;
- rotate the integration token if logs show connections to unapproved hosts;
- search tool logs for
set_skywalking_url,SW-URL, private addresses and unusual GraphQL errors; - correlate MCP calls with DNS, firewall, proxy and backend logs;
- add negative tests for loopback, metadata, IPv6 and redirects;
- ensure logs omit tokens and full sensitive responses.
Do not test the vulnerability by pointing a production server at real internal resources. Use synthetic services and credentials in an isolated environment, and validate the policy decision and log rather than attempting to retrieve a secret.
Detection and architecture conclusions
Alert when a connector changes host after startup, resolves outside its allowlist, contacts private space other than its approved backend, or submits an unrecognised GraphQL operation. Recording a static document hash, operation name and cost can be useful without retaining customer data.
The affected 0.1.0 release, flaw classes and 0.2.0 upgrade come from Apache’s announcement and the CVE record. Prompt-injection paths, network controls, credential rotation and detection are Breachroad analysis. We do not claim every vulnerable instance was exploited or that the CVE has identical impact in every network.
This makes a useful joint exercise for AI, platform and SOC teams. AI and cybersecurity training demonstrates how data becomes a tool action. An AI security assessment can verify MCP registries, egress, credentials and GraphQL policy in the deployed architecture.
