CVE-2023-44312 is a medium severity (CVSS 5.8) information exposure flaw in Apache ServiceComb Service-Center through version 2.1.0. The advisory says an attacker can query all environment variables of the server. Apache recommends upgrading to version 2.2.0, which fixes the issue.
What's affected
The record and the Apache advisory agree: Apache ServiceComb Service-Center through version 2.1.0 is affected, described as before 2.1.0 inclusive, and version 2.2.0 is the fixed release. The Apache advisory, as relayed on the oss-security list, says an attacker can query all the environment variables of the service-center server. Environment variables often hold database passwords, tokens and cloud keys.
The record scores 5.8 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The weakness is CWE-200. The record does not mark the CVE as known exploited, and the advisory text we read does not claim exploitation. The record lists the product as Apache ServiceComb in general, while the advisory narrows it to the Service-Center component, so check that you run that component and not other ServiceComb projects.
How to check if you're exposed
- Find Service-Center in your environment. It is often deployed as a container image or a binary on a Kubernetes cluster.
- Read its version, for example from the container image tag or by running the binary with its version option. In Kubernetes,
kubectl get pods -A -o wide | grep -i service-centerand a look at the image tag help. - Versions up to and including 2.1.0 are in scope.
- Check whether the Service-Center frontend is reachable from untrusted networks.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Upgrade Apache ServiceComb Service-Center to version 2.2.0 or later.
- Keep the frontend and API behind internal networks or an authenticating proxy.
- Review which secrets are in the server's environment and rotate any that could have been exposed.
- Restrict outbound traffic from the Service-Center host to what it needs.
- Check the Apache advisory thread for later updates.
Why it matters
Exposure of sensitive information means the service gives data to someone who should not see it. Here the data is the process environment, which is where many deployments keep secrets. Even a low confidentiality score can understate the value if the environment holds a database password or a cloud token.
The vector shows a scope change, which means the effect can reach beyond Service-Center itself. A service registry sits at the centre of a microservice system, so a leak there can open doors to other services.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What data is exposed?
The advisory says an attacker can query all environment variables of the service-center server.
Which version fixes it?
Apache ServiceComb Service-Center 2.2.0.
Sources
Last reviewed: 19 October 2026.
