Apache Atlas has a Code Injection Vulnerability

🗓️ 04 May 2026 18:30:29Reported by GitHub Advisory DatabaseType

Apache Atlas DSL search allows code injection via Gremlin traversal; affects versions 0.8-incubating to 2.4.0; exploitable when atlas.dsl.executor.traversal=false; upgrade to 2.5.0.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-40563	4 May 202615:17	–	attackerkb
CNNVD	Apache Atlas 代码注入漏洞	4 May 202600:00	–	cnnvd
CVE	CVE-2026-40563	4 May 202615:17	–	cve
Cvelist	CVE-2026-40563 Apache Atlas: Script injection allows access to unintended data	4 May 202615:17	–	cvelist
EUVD	EUVD-2026-26979	4 May 202615:17	–	euvd
NVD	CVE-2026-40563	4 May 202616:16	–	nvd
OSV	CLEANSTART-2026-DV46415 Security fixes in apache-hive 4.0.1-r5	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-SH44648 Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-2047, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2022-36364, CVE-2022-41881, CVE-2023-20861, CVE-2023-20863, CVE-2023-26048, CVE-2023-26049, CVE-2023-2976, CVE-2023-34462, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900, CVE-2023-42503, CVE-2023-44981, CVE-2024-13009, CVE-2024-23454, CVE-2024-23944, CVE-2024-25710, CVE-2024-26308, CVE-2024-29131, CVE-2024-29133, CVE-2024-38808, CVE-2024-38820, CVE-2024-38827, CVE-2024-47554, CVE-2024-47561, CVE-2024-52046, CVE-2024-6763, CVE-2024-7254, CVE-2024-8184, CVE-2025-11143, CVE-2025-22233, CVE-2025-24970, CVE-2025-25193, CVE-2025-27821, CVE-2025-41242, CVE-2025-41249, CVE-2025-48734, CVE-2025-48924, CVE-2025-49128, CVE-2025-52999, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419, CVE-2025-67735, CVE-2025-68161, CVE-2025-8916, CVE-2026-0636, CVE-2026-22745, CVE-2026-2332, CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-40490, CVE-2026-40563, CVE-2026-41417, CVE-2026-41603, CVE-2026-42578, CVE-2026-42579, CVE-2026-42583, CVE-2026-42586, CVE-2026-43869, CVE-2026-44248, CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45300, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47244, CVE-2026-47691, CVE-2026-50193, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-5588, ghsa-3244-j874-rhc2, ghsa-3qp7-7mw8-wx86, ghsa-58qw-p7qm-5rvh, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-5xrh-qmmq-w6ch, ghsa-676x-f7gg-47vc, ghsa-6ghj-frrj-jjj3, ghsa-72hv-8253-57qq, ghsa-cc37-9q2j-3hfv, ghsa-fmxf-pm6p-7xgm, ghsa-mj4r-2hfc-f8p6, ghsa-w573-9ffj-6ff9, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 4.0.1-r0, 4.0.1-r1, 4.0.1-r2, 4.0.1-r3, 4.0.1-r4, 4.0.1-r5	21 Jul 202607:39	–	osv
OSV	GHSA-35XX-9XRG-GWHF Apache Atlas has a Code Injection Vulnerability	4 May 202618:30	–	osv
Positive Technologies	PT-2026-36788	4 May 202600:00	–	ptsecurity

Vulners

Node

org.apache.atlas apache-atlasRange0.8–2.5.0maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40563
lists	www.lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl
openwall	www.openwall.com/lists/oss-security/2026/05/03/9
github	www.github.com/advisories/GHSA-35xx-9xrg-gwhf

08 May 2026 17:47Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

EPSS0.00464

SSVC

CWE-94