EUVD-2026-63396
GHSA-2wf7-pq8q-vp44
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-accessible application requiring authenticated low-privilege session; only confidentiality impact (template data read) supported by description; availability impact not independently substantiated.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732
AnalysisAI
Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not designated template responsible persons to view template configurations they should not have access to. The CVE is tagged CWE-400 (Uncontrolled Resource Consumption) and classified as Denial of Service, yet the description describes an access control bypass - this is a data contradiction that analysts should flag before making control decisions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in Apache InLong - the attacker must be a logged-in user of the platform but specifically one who is NOT assigned as a 'template responsible person' for the targeted template. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or score has been published by NVD or the reporter, making quantitative risk comparison impossible from available data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache InLong 2.4.0 or later, which is the vendor-confirmed fix version per the advisory at https://lists.apache.org/thread/b7bvsg59bo619rywwpd7tj66rkzz62k4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Inlong
View allSQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbNa
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command exe
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless o
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated u
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote att
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-contro
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administr
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack sur
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today