CVE-2026-85499

EUVD-2026-97334

12.10.2026, 12:17

Improper Authorization vulnerability in Apache SkyWalking BanyanDB.

The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy.

This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-863 - Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References

https://lists.apache.org/thread.html/qz1ogm6b37gfqq04y0lkdj8x1zr5cb4r

http://www.openwall.com/lists/oss-security/2026/09/28/5