CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

EUVD-2026-63403

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

CVE-2026-63040

Apache InLong versions 2.0.0 through before 2.4.0 are affected by a missing authorization check in the StreamSource component (specifically the forceDelete function). Any authenticated user can logically delete all stream sources , resulting in high integrity and availability impact (CVSS 3.1 sco...

EUVD-2026-63402

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

EUVD-2026-63400

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

CVE-2026-63039

CVE-2026-63039 is an SQL injection (CWE-89) in Apache InLong's manager component, specifically in AuditAlertRuleEntityMapper.selectByCondition. The root cause is MyBatis ${} string interpolation of attacker-controlled orderField and orderType fields in the ORDER BY clause, allowing arbitrary SQL ...

CVE-2026-63038

CVE-2026-63038 is a CRITICAL (CVSS 9.8) SQL injection vulnerability in Apache InLong versions 2.0.0 through before 2.4.0 . The root cause is string concatenation in SQL command construction, allowing an unauthenticated, remote attacker to inject arbitrary SQL code through the dbName, tableName, s...

CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

EUVD-2026-63399

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63037

CVE-2026-63037 is an unauthenticated SQL injection in Apache InLong (versions 2.0.0 through before 2.4.0 ), targeting the ORDER BY clause of the Manager OpenAPI audit alert rule list endpoint against the backend database. The flaw requires no authentication (CVSS 3.1: 9.8 CRITICAL , vector AV:N/A...

EUVD-2026-63398

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63016 Apache InLong: Ordinary users can create new packages

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

EUVD-2026-63397

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-63016

Apache InLong versions 2.0.0 through 2.3.x have an Uncontrolled Resource Consumption flaw where unauthenticated network users can upload non-official packages, potentially disrupting availability (CVSS 5.3, MEDIUM). Fix: upgrade to 2.4.0 or cherry-pick PRs #12095 and #11732. No exploitation obser...

CVE-2026-63015

CVE-2026-63015 is an Uncontrolled Resource Consumption vulnerability in Apache InLong (versions 2.0.0 through before 2.4.0). The flaw allows non-template responsible persons to view template information, which should be restricted. The CVSS 3.1 score is 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:...