CVE-2026-85499

Executive Summary

CVE-2026-85499 is an improper authorization vulnerability (CWE-863) in the Canopy component of Apache SkyWalking BanyanDB versions from 0.11.0 before 0.11.1. Under a non-default configuration in which a readonly Canopy user is defined and a monitoring target is reachable, that readonly user can route non-read requests through the monitoring proxy, violating the intended read-only authorization boundary. The impact is unauthorized state-changing actions against reachable monitoring targets, not full compromise of BanyanDB itself.

Technical Analysis

The flaw is an authorization/access-control defect, specifically CWE-863 (Incorrect Authorization), in the Canopy monitoring proxy. According to the vendor description, BanyanDB 0.11.0 shipped "incomplete proof-of-concept role and monitoring-proxy functionality." The monitoring proxy is intended to pass monitoring requests to a reachable monitoring target on behalf of authenticated Canopy users. Because the role enforcement in this PoC-stage code is incomplete, a user assigned the readonly role is not reliably restricted to read-only operations when using the proxy; the proxy does not correctly enforce the read-only constraint and permits non-read (state-changing) requests to be forwarded to the monitoring target.

Two preconditions are explicit in the advisory:

1. A non-default configuration — the deployment must have a readonly Canopy user configured.
2. A reachable monitoring target — the proxy must have a valid upstream/target to which requests are forwarded.

When both hold, the readonly user can send non-read requests through the monitoring proxy. The vulnerability is an authorization bypass of the readonly role restriction, not an authentication bypass and not a memory-safety defect. There is no indication of remote code execution, SQL injection, or deserialization. The core weakness is that the proxy layer trusts the caller's authorization context insufficiently and applies incomplete role checks for the mutating methods it can relay.

The exact internal enforcement point (e.g., the proxy handler or role-check middleware) is not named in the available advisory text. Descriptions beyond the observable behavior above — including specific endpoint paths, parameter names, or function identifiers — are not available, and no public PoC exists. Analysis of exploitation mechanics must therefore remain at the authorization-bypass class level rather than at the level of specific code symbols.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-85499; the following attack chain is inferred from the vulnerability class (CWE-863, incorrect authorization in a proxy) and the vendor description.

1. Reconnaissance / target identification. An attacker first identifies an exposed BanyanDB Canopy deployment — typically by discovering the Canopy monitoring proxy service on the network. The attacker needs valid credentials for a readonly Canopy user. In environments where such an account is provisioned (the non-default configuration), these credentials may be obtained through credential reuse, leaked configuration, shared service accounts, or low-privilege access already granted to a partner or monitoring integration. The attacker also benefits from knowing or being able to discover a reachable monitoring target behind the proxy.

2. Triggering the flaw class. With authenticated access as the readonly user, the attacker submits a request through the monitoring proxy using a non-read (state-changing) HTTP method or operation. Due to the incomplete authorization logic, the read-only restriction is not enforced for that request path, so the proxy forwards the mutating request instead of rejecting it. This is the incorrect-authorization step: the role check is either missing or applied only to read operations, letting a write-class request pass.

3. Payload / execution. At the vulnerability-class level, the payload is a non-read request relayed via the monitoring proxy to the reachable monitoring target. The attacker does not need to exploit a memory-safety bug or inject code; the exploit is the authorization decision itself. Because no public PoC discloses the exact request shape, specific endpoints, or parameters, no concrete payload can be provided from the available data.

4. Post-exploitation impact. The attacker can perform unauthorized state-changing operations against the reachable monitoring target, bounded by what the proxy can relay and by the privileges of the proxied connection. The blast radius is limited by the readonly user's intended scope and by the reachable monitoring target, but integrity of monitoring data and potentially downstream configuration that the target can modify may be affected. There is no evidence of confidentiality compromise beyond what the monitoring target exposes, and no evidence of lateral movement to the BanyanDB control plane itself.

Impact Assessment

Business impact centers on integrity and authorization-boundary violation in monitoring infrastructure. A readonly user — a principal that should never mutate state — can cause changes on a reachable monitoring target. Depending on what that target is and what the proxy can reach, consequences include tampering with monitoring configuration or data, disrupting observability, or using the monitoring target as a pivot within the monitoring segment.

Affected systems: Apache SkyWalking BanyanDB 0.11.0 Canopy deployments that satisfy both preconditions — a configured readonly Canopy user and a reachable monitoring target. Default deployments that do not provision a readonly user, or that have no reachable monitoring target behind the proxy, are not exposed.

CVSS reference: no official CVSS score or vector is assigned for this CVE in the available data; the score and vector above are assessment placeholders and must not be cited as authoritative. The practical severity is highest in multi-tenant or shared monitoring deployments where readonly accounts are broadly issued (e.g., to dashboards, partners, or read-only integrations). In those environments the flaw converts a low-privilege, read-only principal into a write-capable one against the monitoring target. Blast radius is constrained by the reachable target and the proxy's relayed privilege, which keeps overall risk moderate rather than critical, but the violation of an explicit security boundary (readonly) makes it a meaningful authorization defect for affected configurations.

Detection Guidance

Sigma Rule

title: Potential BanyanDB Canopy Readonly User Non-Read Request via Monitoring Proxy
id: 8f2a1c4e-7b6d-4a9e-9c3f-2d5e6a7b8c90
status: experimental
description: Detects a readonly Canopy user issuing non-read (state-changing) HTTP methods through the BanyanDB Canopy monitoring proxy, indicating exploitation of CVE-2026-85499.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85499
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
      - DELETE
  selection_path:
    cs-uri-stem|contains:
      - '/canopy'
      - '/proxy'
      - '/monitoring'
  selection_role:
    cs-username|contains: 'readonly'
  condition: selection_method and selection_path and selection_role
falsepositives:
  - Legitimate administrative actions performed by non-readonly accounts (excluded by the role matcher)
  - Monitoring integrations that legitimately use POST for query APIs
level: medium
tags:
  - attack.t1190
  - cve.2026.85499

YARA Rule

rule CVE_2026_85499_BanyanDB_Canopy_AuthZ_Proxy
{
    meta:
        description = "Detection aid for BanyanDB Canopy monitoring-proxy authorization bypass (CVE-2026-85499); matches textual indicators in request/response artifacts."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85499"
        severity = "medium"

    strings:
        $canopy = "Canopy" ascii wide nocase
        $banyandb = "BanyanDB" ascii wide nocase
        $proxy = "monitoring-proxy" ascii wide nocase
        $readonly = "readonly" ascii wide nocase
        $method_post = "POST /" ascii nocase
        $method_put = "PUT /" ascii nocase
        $method_delete = "DELETE /" ascii nocase

    condition:
        filesize < 2MB and
        ($banyandb or $canopy) and
        $readonly and
        ($proxy or $method_post or $method_put or $method_delete)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85499 Potential BanyanDB Canopy Readonly User Non-Read Request via Monitoring Proxy"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/canopy"; http.uri; content:"/proxy"; http.header; content:"Cookie"; reference:cve,2026-85499; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85499; classtype:attempted-user; sid:202685499; rev:1;)

alert http any any -> any any (msg:"CVE-2026-85499 BanyanDB Canopy State-Changing Method on Monitoring Proxy"; flow:to_server,established; http.method; pcre:"/^(PUT|PATCH|DELETE)$/"; http.uri; content:"/canopy"; reference:cve,2026-85499; classtype:attempted-user; sid:202685500; rev:1;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ network where http.request.method == "GET" and url.path : ("/canopy*" or "*/proxy*" or "*/monitoring*") ]
  [ network where http.request.method in ("POST", "PUT", "PATCH", "DELETE") and url.path : ("/canopy*" or "*/proxy*" or "*/monitoring*") and user.name : "*readonly*" ]

Splunk SPL Query

index=web OR index=proxy
(http_method=POST OR http_method=PUT OR http_method=PATCH OR http_method=DELETE)
(uri_path="*canopy*" OR uri_path="*proxy*" OR uri_path="*monitoring*")
(uri_path="*readonly*" OR user="*readonly*" OR cs_username="*readonly*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths by src_ip, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table src_ip user count paths first_seen last_seen

Wazuh OSSEC Rule

<group name="apache,banyandb,web,">
  <rule id="2026854" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>Canopy</match>
    <regex>(POST|PUT|PATCH|DELETE)\s+.*(?:/canopy|/proxy|/monitoring)</regex>
    <description>CVE-2026-85499: Non-read request on BanyanDB Canopy monitoring proxy.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85499,authorization_bypass,</group>
  </rule>

  <rule id="2026855" level="12">
    <if_sid>2026854</if_sid>
    <match>readonly</match>
    <description>CVE-2026-85499: Readonly BanyanDB Canopy user issued non-read request via monitoring proxy (possible exploitation).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85499,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note the vendor advisory states version 0.11.1 fixes the issue; this is the vendor-stated fix, but no independently tracked patch artifact was available at time of writing, hence the low patch-confidence score.

1. Immediate mitigations:

• Remove or disable readonly Canopy user accounts wherever they are not strictly required, thereby breaking the non-default configuration precondition.
• Where readonly Canopy users are required, do not allow a reachable monitoring target to be configured behind the Canopy monitoring proxy; isolate or remove the proxy target to eliminate the second precondition.
• Network-isolate the Canopy monitoring proxy so that only trusted, non-readonly administrative networks can reach it; block untrusted and partner networks at the perimeter.
• Restrict reachability from the proxy to monitoring targets using network segmentation and allowlisting, so that even if the authorization bypass is triggered, reachable targets are minimal.
• Monitor access logs for readonly-principal use of non-read HTTP methods against Canopy/proxy paths (see detection guidance above).

2. Patch/upgrade steps:

• Upgrade Apache SkyWalking BanyanDB from 0.11.0 to 0.11.1, which the vendor advisory states fixes the issue.
• After upgrading, verify that the Canopy monitoring proxy correctly rejects non-read requests from readonly users; regression-test role enforcement before restoring any readonly accounts.
• Re-enable any readonly Canopy users and monitoring proxy targets only after the fix is confirmed in the deployed version.

3. Long-term hardening:

• Treat the Canopy monitoring-proxy role model as production-sensitive; avoid deployments based on proof-of-concept functionality for security-relevant authorization paths.
• Enforce role-based access control at the proxy boundary with deny-by-default semantics for mutating HTTP methods, independent of upstream targets.
• Apply least privilege to all Canopy accounts and avoid shared service accounts, reducing the value of a low-privilege credential.
• Integrate the Sigma/Suricata/Wazuh detections above into monitoring, and review any alerts involving readonly principals issuing state-changing requests.
• Track the Apache SkyWalking BanyanDB release notes for follow-up security fixes on the Canopy authorization path.

References

• NVD — CVE-2026-85499: https://nvd.nist.gov/vuln/detail/CVE-2026-85499
• Apache SkyWalking BanyanDB project and security advisories: https://skywalking.apache.org/ (upgrade guidance to 0.11.1)
• Apache Software Foundation security page: https://apache.org/security/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-85499 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-85499, and no threat-actor campaign or in-the-wild exploitation has been reported in the available data.