Moderate: Red Hat Security Advisory: mod_md security update

An update for modmd is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-63043

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

CVE-2026-63042

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63044

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63038

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63037

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

CVE-2026-63016

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-63040

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

CVE-2026-63015

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63044

CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong Manager , affecting versions 2.0.0 through before 2.4.0 . Any authenticated user (no admin role required) can abuse the POST /api/node/testConnection endpoint to force the server to make outbound HTTP requests o...

EUVD-2026-63477

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

EUVD-2026-63475

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

CVE-2026-63043

CVE-2026-63043 is a Relative Path Traversal vulnerability in Apache InLong 's Agent component, caused by an unvalidated file source path . An unauthenticated attacker over the network can exploit this to perform arbitrary file read from the Agent host filesystem, resulting in high confidentiality...

CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

EUVD-2026-63403

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

CVE-2026-63040

Apache InLong versions 2.0.0 through before 2.4.0 are affected by a missing authorization check in the StreamSource component (specifically the forceDelete function). Any authenticated user can logically delete all stream sources , resulting in high integrity and availability impact (CVSS 3.1 sco...