EUVD-2026-63477
GHSA-qvfh-v498-xrrf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible SSRF requiring low-privilege authentication, scope change to internal systems; no direct integrity or availability impact on the vulnerable component.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12130 .
AnalysisAI
Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administrative role required - to coerce the Manager service into issuing outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This effectively turns the InLong Manager into an open proxy for internal network reconnaissance, enabling access to otherwise firewalled services such as cloud instance metadata endpoints, internal APIs, or database management interfaces. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on Apache InLong Manager - any user account with login access qualifies; administrative role is explicitly not required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Without a published CVSS vector, risk must be inferred from the vulnerability class and conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache InLong to version 2.4.0 or later as the primary remediation, per the vendor advisory at https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an inventory of all Apache InLong Manager instances running versions 2.0.0-2.3.x and document current user access levels to quantify exploitation risk; begin blocking outbound network access from these instances where architecturally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Inlong
View allSQL injection in Apache InLong versions 2.0.0 through 2.3.x allows remote attackers to inject arbitrary SQL via the dbNa
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command exe
Missing authorization enforcement in Apache InLong's StreamSource component allows any authenticated user - regardless o
Broken access control in Apache InLong's manager component exposes Data Node management endpoints to any authenticated u
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote att
SQL injection in Apache InLong versions 2.0.0 up to (but not including) 2.4.0 allows attackers to inject attacker-contro
Uncontrolled Resource Consumption (CWE-400) in Apache InLong versions 2.0.0 through 2.3.x exposes two related attack sur
Unauthorized template information disclosure in Apache InLong 2.0.0 through 2.3.x allows authenticated users who are not
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today