CVE-2026-85499

Summary

An improper authorization flaw in Apache SkyWalking BanyanDB allows attackers to bypass read-only access controls through a monitoring proxy, enabling them to execute non-read operations despite having only readonly permissions. This vulnerability affects versions 0.11.0 before 0.11.1 and can lead to unauthorized data manipulation or exposure.

Exploitability

Exploitation requires a non-default configuration with a readonly user and a reachable monitoring target, making it moderately difficult but possible for attackers who can interact with the monitoring proxy.

Blast radius

The vulnerability could allow attackers to perform unauthorized write operations on monitored systems, potentially leading to data corruption or unauthorized access to sensitive monitoring data across affected BanyanDB instances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.11.1, which fixes the improper authorization issue in the monitoring proxy functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.