Description

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:20:17.070Z",
  "pubdate": "2026-08-28T20:20:17.070Z",
  "executiveSummary": "Zipkin versions through 3.6.1 contain a critical security vulnerability involving the unintentional exposure of Spring Boot Actuator endpoints on the tracing API port. These management endpoints are exposed without requiring any form of authentication, granting remote, unauthenticated attackers the ability to interface with internal application management features.\nThe vulnerability poses a severe risk to confidentiality and integrity. Successful exploitation allows unauthorized parties to extract sensitive system metadata, including environment variables, bean definitions, and internal storage credentials. Furthermore, the ability to manipulate runtime configurations, such as modifying log levels, provides attackers with the means to suppress audit trails or facilitate further exploitation. This exposure essentially bypasses standard security perimeters, as the administrative API is accessible over the network without prerequisite credentials, leading to potential full system compromise or information leakage.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper configuration of the Spring Boot Actuator module within the Zipkin application. Spring Boot Actuator is designed to expose operational information about the running application, such as health checks, metrics, and environment properties. In Zipkin versions up to 3.6.1, these sensitive management endpoints are bound to the same network interface and port utilized for the public-facing tracing API without being shielded by appropriate authentication or authorization filters.\nThe vulnerability is inherent to the application's network configuration, which fails to isolate management traffic from the primary application services. Because the tracing API port is often exposed to external networks to receive span data, the co-location of Actuator endpoints creates a significant attack surface. An unauthenticated attacker can interact with these endpoints using standard HTTP requests. For example, by querying the '/env' endpoint, an attacker can retrieve a JSON representation of the entire application environment, which frequently includes database connection strings, API keys, and sensitive configuration parameters containing plaintext secrets.\nThe attack flow proceeds as follows: First, the attacker identifies that the Zipkin instance is listening on its designated tracing port. Second, the attacker probes for known Spring Boot Actuator paths (e.g., '/actuator/env', '/actuator/beans', '/actuator/configprops'). Given the lack of authentication, the application responds to these requests with highly sensitive internal data. Third, the attacker may pivot to administrative endpoints such as '/actuator/loggers', where they can alter the logging verbosity. By modifying log levels to 'OFF' or 'FATAL', an attacker can effectively disable auditing mechanisms, thereby masking subsequent malicious activities or preventing the detection of unauthorized access.\nThis vulnerability is particularly dangerous because it grants an attacker visibility into the underlying storage credentials and infrastructure settings. If the Zipkin deployment relies on external cloud services or private databases, the credentials extracted from the '/env' or '/configprops' endpoints can be reused by the attacker to gain unauthorized access to secondary systems, such as backend storage clusters or log management services. The exploitation requires no specific privilege levels, as the application logic fails to validate the requestor's identity before rendering administrative metadata."
}