Apache Allura and SkyWalking BanyanDB: Four Vulnerabilities Disclosed Together
Key findings • Four vulnerabilities disclosed on October 12, 2026, affect Apache Allura and Apache SkyWalking BanyanDB. • Apache Allura versions prior to 1.22.0 are vulnerable to OAuth1 repla…
Key findings
- Four vulnerabilities disclosed on October 12, 2026, affect Apache Allura and Apache SkyWalking BanyanDB.
- Apache Allura versions prior to 1.22.0 are vulnerable to OAuth1 replay attacks, mass assignment, and callback validation flaws.
- CVE-2026-85499 in Apache SkyWalking BanyanDB allows improper authorization under specific configurations.
- Recommended action for Allura users is to upgrade to version 1.22.0.
On October 12, 2026, a batch of four vulnerabilities was disclosed, impacting Apache products. The disclosures, spanning a nine-hour window, highlight security weaknesses in Apache Allura and Apache SkyWalking BanyanDB. The most critical of these, CVE-2026-85499, affects Apache SkyWalking BanyanDB, while three other vulnerabilities, CVE-2026-92120, CVE-2026-92119, and CVE-2026-92116, were found in Apache Allura. These findings underscore the ongoing need for vigilance in securing open-source software components.
The Apache Allura vulnerabilities are clustered around its authentication and API functionalities. CVE-2026-92120, an OAuth1 Request Replay Attack, and CVE-2026-92116, an OAuth1 callback validation vulnerability, both stem from weaknesses in the OAuth1 implementation. Additionally, CVE-2026-92119 points to a REST API Mass Assignment vulnerability, indicating potential issues with how the API handles data binding and authorization. All three Allura vulnerabilities affect versions up to 1.21.0.
In parallel, CVE-2026-85499 was disclosed for Apache SkyWalking BanyanDB. This Improper Authorization vulnerability arises from an incomplete proof-of-concept role and monitoring-proxy functionality within the Canopy component. Under specific non-default configurations, a read-only Canopy user could potentially send non-read requests to a monitoring target, bypassing intended access controls.
The vulnerabilities in Apache Allura have been addressed by the vendor. Users are strongly recommended to upgrade to version 1.22.0 to mitigate the risks associated with CVE-2026-92120, CVE-2026-92119, and CVE-2026-92116. The specific fix for CVE-2026-85499 in Apache SkyWalking BanyanDB is not detailed in the provided information, but users are advised to consult the official Apache SkyWalking advisories for the latest patch status and recommended actions.
This coordinated disclosure event serves as a reminder for organizations relying on Apache software to maintain robust patch management practices. Regularly updating components like Allura and SkyWalking is crucial to protect against potential exploitation of these types of vulnerabilities. The close timing of these disclosures suggests a focused review or audit of these Apache projects, leading to the identification of multiple security flaws.
Users should prioritize updating Apache Allura to version 1.22.0. For Apache SkyWalking BanyanDB, it is essential to monitor official Apache security channels for any new information or patches related to CVE-2026-85499. Staying informed and applying updates promptly are key defense mechanisms against emerging threats.