Apache InLong CVE-2026-63043

No special conditions apply - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against default configurations of Apache InLong Agent versions 2.0.0 through 2.3.x. Exploitation is bounded to those specific versions; InLong 2.4.0 and later are not affected. The primary limiting factor is network exposure: attackers must be able to reach the InLong Agent service port. Organizations that firewall Agent ports to only trusted upstream InLong Manager or pipeline nodes significantly reduce exposure. No authentication, elevated privileges, or user interaction are required, and no non-default configuration is needed to be vulnerable.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity network-accessible unauthenticated file read with no interaction barrier. However, EPSS at 0.21% (12th percentile) and absence from CISA KEV indicate this vulnerability has not yet attracted mass exploitation activity. The divergence between a high CVSS and low EPSS is typical for path traversal issues whose real-world impact depends heavily on whether the Agent port is reachable from untrusted networks - internet-exposed InLong deployments carry substantially higher risk than those firewalled to internal data pipeline infrastructure. Impact is limited to confidentiality (C:H); no integrity or availability damage is possible via this flaw alone, but file content obtained (credentials, private keys, configuration) could enable further attacks. Priority should be elevated for organizations running InLong Agents with external or broad internal network exposure.

An unauthenticated remote attacker with network access to an exposed InLong Agent endpoint sends a crafted HTTP request embedding relative path traversal sequences (e.g., '../../etc/shadow' or '../../proc/self/environ') in a file-referencing parameter. The Agent resolves the path without sanitization, returning the contents of the targeted file. The attacker uses the disclosed data - credentials, API keys, TLS private keys, or configuration files - as a foothold for lateral movement.