CVE-2026-82265: Missing Authentication for Critical Function in openzipkin zipkin

CVE-2026-82265 describes a missing authentication vulnerability in openzipkin's Zipkin product through version 3.6.1. The issue arises because Spring Boot Actuator endpoints are exposed on the tracing API port without requiring authentication. This exposure permits unauthenticated attackers to read sensitive configuration data including environment variables, bean configurations, and storage credentials. Additionally, attackers can alter log levels to reduce or suppress logging, potentially hindering detection of malicious activity.

Unauthenticated attackers can access sensitive internal configuration data and credentials, increasing the risk of further compromise. The ability to modify log levels may allow attackers to evade detection by suppressing logging of their activities. This could lead to unauthorized access, information disclosure, and reduced visibility into system events.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the tracing API port and actuator endpoints, for example by network segmentation or firewall rules, to prevent unauthenticated access.