Apache InLong CVE-2026-63038

Exploitation requires network reachability to the Apache InLong component that processes the dbName, tableName, schemaName, or username parameters - typically the InLong Manager/data-source configuration interface - running a vulnerable version between 2.0.0 and 2.3.x. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is nominally required, but the practical limiting factor is exposure: the attacker must be able to send requests to that endpoint, so deployments that keep the InLong console on an internal/management-only network or behind an authenticating gateway substantially raise the bar. Whether the vulnerable endpoint is genuinely pre-authentication in a given install should be verified, as this is the key determinant of real-world reachability.

The signals here are genuinely mixed and worth reconciling. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes an unauthenticated, network-reachable, low-complexity flaw with full CIA impact - the theoretical worst case. Against that, EPSS is only 0.21% (11th percentile) and there is no KEV listing and no public PoC, indicating that real-world weaponization has not materialized and mass exploitation is not currently observed. The tension is that SQL injection in an unauthenticated management parameter is exactly the class attackers eventually automate, so the low EPSS likely reflects the product's modest deployment footprint and recency of disclosure rather than any intrinsic difficulty. One caveat on the CVSS itself: whether these parameters are truly reachable pre-authentication depends on how the affected InLong endpoint is exposed and whether the Manager/console sits behind auth in a given deployment - if the vulnerable endpoint normally requires a logged-in operator, effective privilege requirements are higher than PR:N implies, so verify exposure in your own environment. Net: a real, patchable priority for anyone running InLong 2.0.0-2.3.x, but the absence of active exploitation means it can be scheduled as an expedited patch rather than an emergency out-of-band response.

An attacker who can reach an exposed Apache InLong management endpoint submits a request in which the dbName or tableName parameter contains a crafted SQL payload; because the identifier is concatenated into a backend query, the injected clause executes against InLong's database. Given AV:N/AC:L and full CIA impact, the attacker can read or modify stored configuration and pipeline metadata; no public PoC is currently identified, so exploitation would require the attacker to develop the injection string themselves.