Apache InLong CVE-2026-63042

Exploitation requires possession of any valid Apache InLong manager user account (PR:L per CVSS). No administrative role, special group membership, or elevated permission is needed - the vulnerability affects all authenticated users equally because the authorization check on Data Node endpoints is absent or insufficient. There is no requirement for a non-default configuration; any standard InLong deployment in the affected version range with user accounts enabled is vulnerable. Exploitation is network-accessible (AV:N) with no user interaction required (UI:N). Unauthenticated attackers cannot exploit this vulnerability. The primary limiting factor is obtaining a valid manager credential, which is the sole barrier between an external attacker and full Data Node manipulation.

The CVSS 8.1 score is supported by a network-accessible attack vector, low complexity, and no user interaction required - but the PR:L metric is the critical limiting factor: exploitation is gated on holding any valid InLong manager credential. The EPSS score of 0.17% (7th percentile) is very low, indicating the research community assigns minimal near-term exploitation probability, consistent with the absence of a CISA KEV listing or known POC. The real-world threat model is primarily insider threat or post-initial-access lateral movement - an attacker who compromises any InLong account, even a low-privileged one, can immediately disrupt or corrupt the entire data pipeline infrastructure by deleting Data Node definitions. The high I:H/A:H impact is plausible given that Data Nodes are foundational to all pipeline operations. No conflict exists between the CVSS vector and the description. Overall, this is a meaningful but not immediately critical priority unless InLong manager accounts are broadly distributed or externally exposed.

An attacker holding any valid InLong manager credential - acquired through phishing, credential stuffing, or lateral movement - authenticates to the manager API over the network and issues HTTP requests to the Data Node management endpoints. Without further privilege escalation, the attacker deletes or modifies Data Node definitions, severing data source and destination configurations and causing pipeline failures across all dependent workflows. No public exploit code has been identified, so exploitation currently requires manual API interaction by a knowledgeable attacker.