EUVD-2026-63402
GHSA-3q63-2qmj-vfp6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
StreamSource API is network-reachable, requires only a low-privileged account, causes full integrity and availability loss via mass deletion, with no confidentiality impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12145 .
AnalysisAI
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless of role - to logically delete all stream sources across the platform. Versions 2.0.0 through 2.3.x are affected; the root cause is CWE-552, where the StreamSource API performs no access-control check before executing the delete operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on an Apache InLong instance running versions 2.0.0 through 2.3.x; the CVSS PR:L metric confirms that a low-privileged account - not administrator access - is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score is driven by network accessibility (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and dual high impact on integrity and availability (I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache InLong to version 2.4.0 or later, as directed in the vendor advisory at https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to confirm Apache InLong deployment and affected version status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Inlong
View allSQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbNa
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command exe
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated u
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote att
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-contro
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administr
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack sur
Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today