Unauthenticated Actuator Endpoints in Zipkin (Information Disclosure + Log Manipulation)

reported via email on 27 May 2026 - no response:

I am reporting security issues in openzipkin/zipkin 3.6.1 (latest) affecting the default configuration.

ISSUE 1 -- Unauthenticated Spring Boot Actuator Endpoints (Information Disclosure)

Zipkin enables and exposes the following Spring Boot Actuator endpoints on the same port as the tracing API (9411) with no authentication:

• GET /actuator/env -- full runtime environment and configuration properties
• GET /actuator/beans -- all Spring beans (19 KB of internal wiring detail)
• GET /actuator/threaddump -- live JVM thread dump (64 threads in default container)
• GET /actuator/conditions -- auto-configuration report
• GET /actuator/configprops -- all @ConfigurationProperties bindings

Any unauthenticated caller on the network can read these. When storage backends are configured with credentials that do not match Spring's default sanitization patterns, those credentials are exposed in /actuator/env.

Validated against openzipkin/zipkin:latest: curl -s http://target:9411/actuator/env -> HTTP 200, propertySources with configuration detail

ISSUE 2 -- Unauthenticated Log Level Manipulation (+ CORS cross-origin)

POST /actuator/loggers/{name} is also unauthenticated. An attacker who can reach port 9411 can set the root logger to OFF, disabling all Zipkin logging:

curl -X POST http://target:9411/actuator/loggers/root
-H "Content-Type: application/json"
-d '{"configuredLevel":"OFF"}' -> HTTP 204

Because the CORS policy defaults to Access-Control-Allow-Origin: * with GET and POST allowed, this is also exploitable cross-origin from any web page targeting a Zipkin instance on an internal network:

fetch("http://zipkin.internal:9411/actuator/loggers/root", { method: "POST", headers: {"Content-Type": "application/json"}, body: JSON.stringify({configuredLevel: "OFF"}) }); -> HTTP 204 (no CORS error)

ROOT CAUSE

zipkin-server-shared.yml explicitly includes LoggersEndpointAutoConfiguration, EnvironmentEndpointAutoConfiguration, BeansEndpointAutoConfiguration, ThreadDumpEndpointAutoConfiguration, and management.endpoints.web.exposure.include: '*'. No Spring Security or Armeria auth gate exists.

RECOMMENDED FIX

1. Move actuator to a separate management port (management.server.port) not exposed externally.
2. Remove LoggersEndpointAutoConfiguration from the default include list, or gate it.
3. Add documentation warning operators to set management.endpoint.loggers.enabled=false in production.
4. Consider whether the CORS wildcard with POST is appropriate given the loggers write path.