---
id: CVE-2026-82265
title: >-
  Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API
  port without authentication, allowing unauthenticated attackers to access
  sensitive information
summary: >-
  Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API
  port without authentication, allowing unauthenticated attackers to access
  sensitive information. Attackers can read environment variables, bean
  configurations…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-306
vendor: openzipkin
product: zipkin
affected:
  - zipkin <= 3.6.1
published: '2026-08-28'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:28:01.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82265'
references:
  - url: 'https://github.com/openzipkin/zipkin'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openzipkin/zipkin/blob/878ce2a1fad54ca941d17fdcf2e1d924b148eb1f/zipkin-server/src/main/resources/zipkin-server-shared.yml
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openzipkin/zipkin/issues/3835'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zipkin-unauthenticated-spring-boot-actuator-endpoints-exposure
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00449
epssPercentile: 0.36258
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-31T18:43:06.150767Z'
ingestedAt: '2026-09-24T15:45:56.695Z'
---

## Overview

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.