Zipkin versions up to and including 3.6.1 expose Spring Boot Actuator endpoints on the tracing API port without any authentication. This allows an unauthenticated attacker to query the actuator interfaces and read environment variables, bean configuration data, and storage credentials, as well as modify log levels to suppress logs. The primary weakness is the absence of access control, identified as CWE‑306, leading to an information‑disclosure and potential operational degradation risk.

The vulnerability affects the Zipkin service provided by the openzipkin community. All releases through version 3.6.1 are impacted; newer releases are not documented as vulnerable. The exposed endpoints are the standard Spring Boot Actuator URLs exposed on Zipkin’s API port.

The CVSS score of 6.9 classifies the issue as medium severity. An attacker who can reach the tracing API port can immediately invoke the unprotected actuator APIs, bypassing authentication. While the EPSS score is not available, the exposure of sensitive internal data without authentication indicates a high likelihood of exploitation in environments where the API port is network accessible. Because the vulnerability is not listed in CISA’s KEV catalog, it may not yet have widespread exploitation, but the lack of authentication is a critical risk for any publicly exposed deployment.