EUVD-2026-63403
GHSA-jmq8-hg35-36h2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Manager API is network-reachable; any authenticated user exploits it with no complexity; no confidentiality impact since only configuration write access is described.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12161 .
AnalysisAI
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated user, regardless of their assigned role or privilege level. Versions 2.0.0 through 2.3.x are affected, allowing any valid manager account holder to create, modify, or delete Data Node definitions that underpin the platform's data pipeline infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of any valid Apache InLong manager user account (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score is supported by a network-accessible attack vector, low complexity, and no user interaction required - but the PR:L metric is the critical limiting factor: exploitation is gated on holding any valid InLong manager credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is upgrading to Apache InLong 2.4.0, which addresses the authorization bypass in Data Node management per the vendor advisory at https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Apache InLong deployments using versions 2.0.0 through 2.3.x and review Data Node management logs for unauthorized activity or suspicious modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Inlong
View allSQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbNa
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command exe
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless o
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote att
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-contro
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administr
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack sur
Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today