Apache InLong CVE-2026-63040

Exploitation requires a valid authenticated session on an Apache InLong instance running versions 2.0.0 through 2.3.x; the CVSS PR:L metric confirms that a low-privileged account - not administrator access - is sufficient. No special non-default configuration, specific protocol, or optional feature must be enabled: StreamSource is a core InLong component present in all standard deployments within the affected range. Exploitation is limited by the need for at least one valid account credential; unauthenticated external actors cannot exploit this directly without first obtaining credentials through a separate attack. The scope is bounded to a single InLong instance (S:U), so lateral compromise of other systems is not a direct consequence of this flaw alone.

The CVSS 8.1 score is driven by network accessibility (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and dual high impact on integrity and availability (I:H/A:H). These metrics are internally consistent with the description: any account holder can reach the endpoint over the network and trigger wholesale stream source deletion with no additional steps. However, the EPSS score of 0.19% at the 9th percentile indicates very low real-world exploitation probability at time of analysis, and the absence from CISA KEV confirms no confirmed active exploitation. The gap between CVSS severity and EPSS probability is plausibly explained by InLong's relatively niche deployment footprint and the insider-threat nature of the attack - external opportunistic attackers must first obtain valid credentials. Remediation urgency is still genuine: the prerequisite is only a valid account, meaning disgruntled employees or compromised low-privilege service accounts represent a realistic threat vector with catastrophic pipeline-disruption impact.

An attacker who holds any valid InLong user account on a vulnerable 2.0.0-2.3.x instance sends repeated DELETE requests to the StreamSource API endpoint. Because no authorization check is performed, each request succeeds and logically removes a stream source. By enumerating and deleting all stream sources, the attacker halts every data ingestion pipeline, causing a full availability outage for downstream consumers. No public proof-of-concept code is currently known, but the attack requires only standard HTTP requests to a documented API.