Not rated
CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP
Description
PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to the socket unencrypted before any redirect response is received. Redirection affects only whether the request is retried securely, not whether the first copy left the host in the clear. This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0. Users are recommended to upgrade to version 11.0.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache SkyWalking 9.6 | 9.6.0 → 11.0.0 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache SkyWalking
The 4 CVEs of Apache SkyWalking →
CVE-2026-85229
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting')…
Not rated
CVE-2026-30778
The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL
Not rated
CVE-2025-54057
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking
Not rated