EUVD-2026-63399
GHSA-8x82-h8qj-qg8w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SQL injection via network-reachable unauthenticated management parameters with low complexity yields full database confidentiality, integrity, and availability impact within an unchanged scope.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/issues/12135 .
AnalysisAI
SQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbName, tableName, schemaName, and username parameters, compromising the integrity and confidentiality of the backend database. The flaw carries a CVSS 9.8 (network, no authentication, no user interaction) and was disclosed by the Apache project itself; a vendor patch exists in 2.4.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Apache InLong component that processes the dbName, tableName, schemaName, or username parameters - typically the InLong Manager/data-source configuration interface - running a vulnerable version between 2.0.0 and 2.3.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are genuinely mixed and worth reconciling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Apache InLong to 2.4.0, which is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Apache InLong deployments and identify any instances running versions 2.0.0 through 2.3.x, restricting network exposure of critical systems where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Inlong
View allArgument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command exe
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless o
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated u
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote att
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-contro
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administr
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack sur
Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today