apache inlong vulnerabilities

Latest apache inlong CVEs

Newest publication first · page 1 of 2

1. CVE-2026-63046 Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials

   Published 2026-08-21

   High·CVSS 8.8 EPSS 0.68%

   Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLon...

2. CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

   Published 2026-08-20

   Medium·CVSS 5.4 EPSS 0.50%

   Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2...

3. CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path

   Published 2026-08-20

   High·CVSS 7.5 EPSS 0.81%

   Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apac...

4. CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints

   Published 2026-08-20

   High·CVSS 8.1 EPSS 0.64%

   Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

5. CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete

   Published 2026-08-20

   High·CVSS 8.1 EPSS 0.64%

   Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrad...

6. CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

   Published 2026-08-20

   Critical·CVSS 9.8 EPSS 0.69%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users...

7. CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report

   Published 2026-08-20

   Critical·CVSS 9.8 EPSS 0.69%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0...

8. CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

   Published 2026-08-20

   Critical·CVSS 9.8 EPSS 0.69%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users a...

9. CVE-2026-63016 Apache InLong: Ordinary users can create new packages

   Published 2026-08-20

   Medium·CVSS 5.3 EPSS 0.63%

   Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick...

10. CVE-2026-63015 Apache InLong: Non-template responsible persons can view template information

    Published 2026-08-20

    Medium·CVSS 4.3 EPSS 0.56%

    Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] h...

11. CVE-2025-27531 Apache InLong: An arbitrary file read vulnerability for JDBC

    Published 2025-06-06

    Critical·CVSS 9.8 EPSS 0.81%

    Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, w...

12. CVE-2025-27528 Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

    Published 2025-05-28

    Critical·CVSS 9.1 EPSS 0.86%

    Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to...

13. CVE-2025-27526 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass

    Published 2025-05-28

    Medium·CVSS 6.5 EPSS 0.86%

    Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-p...

14. CVE-2025-27522 Apache InLong: JDBC Vulnerability during verification processing

    Published 2025-05-28

    Medium·CVSS 6.5 EPSS 0.90%

    Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it....

15. CVE-2024-36268 Apache InLong TubeMQ Client: Remote Code Execution vulnerability

    Published 2024-08-02

    Critical·CVSS 9.8 EPSS 1.2%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it...

16. CVE-2024-26579 Apache Inlong JDBC Vulnerability

    Published 2024-05-08

    Critical·CVSS 9.8 EPSS 1.1%

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https...

17. CVE-2024-26580 Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

    Published 2024-03-06

    Critical·CVSS 9.1 EPSS 1.2%

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to so...

18. CVE-2023-51784 Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager

    Published 2024-01-03

    Critical·CVSS 9.8 EPSS 1.6%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it. [...

19. CVE-2023-51785 Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager

    Published 2024-01-03

    High·CVSS 7.5 EPSS 1.0%

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve...

20. CVE-2023-46227 Apache inlong has an Arbitrary File Read Vulnerability

    Published 2023-10-19

    High·CVSS 7.5 EPSS 1.4%

    Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] ht...

21. CVE-2023-43666 Apache InLong: General user Unauthorized access User Management

    Published 2023-10-16

    Medium·CVSS 6.5 EPSS 0.62%

    Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it....

22. CVE-2023-43667 Apache InLong: Log Injection in Global functions

    Published 2023-10-16

    High·CVSS 7.5 EPSS 1.7%

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and tra...

23. CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong

    Published 2023-10-16

    Critical·CVSS 9.8 EPSS 1.4%

    Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache I...

24. CVE-2023-35088 Apache InLong: SQL injection in audit endpoint

    Published 2023-07-25

    Critical·CVSS 9.8 EPSS 1.6%

    Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. In the toAuditCkSql method, the groupId, streamId, auditId, and dt are direct...

25. CVE-2023-34434 Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param

    Published 2023-07-25

    High·CVSS 7.5 EPSS 1.7%

    Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.