Vulnerabilidades do Apache Software Foundation Inlong
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Inlong: 10 registro(s), com versões afetadas e correções.cpe:2.3:a:apache:inlong
CVE-2026-63046
Alta · 8.8
CWE-88 21/08/2026
Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell
commands via ExcuteLinux.exeCmd() with no filtering or whitelist
validation.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.
[1] https://github.com/apache/inlong/pull/12151 .
[2] https://github.com/apache/inlong/pull/12155 .
CVE-2026-63044
Média · 5.4
CWE-918 20/08/2026
Apache InLong: Authenticated SSRF via POST /api/node/testConnection
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to
arbitrary internal hosts and ports.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12130 .
CVE-2026-63043
Alta · 7.5
CWE-23 20/08/2026
Apache InLong: Agent path traversal via unvalidated file source path
Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12146 .
CVE-2026-63042
Alta · 8.1
CWE-552 20/08/2026
Apache InLong: Missing authorization on DataNode management endpoints
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12161 .
CVE-2026-63040
Alta · 8.1
CWE-552 20/08/2026
Apache InLong: Missing authorization in StreamSource forceDelete
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12145 .
CVE-2026-63039
Crítica · 9.8
CWE-89 20/08/2026
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into
the SQL statement, enabling SQL injection.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12080 .
CVE-2026-63038
Crítica · 9.8
CWE-89 20/08/2026
Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the
dbName, tableName, schemaName, and username parameters.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/issues/12135 .
CVE-2026-63037
Crítica · 9.8
CWE-89 20/08/2026
Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the
Manager backend database.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/issues/12079 .
CVE-2026-63016
Média · 5.3
CWE-400 20/08/2026
Apache InLong: Ordinary users can create new packages
Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732
CVE-2026-63015
Média · 4.3
CWE-400 20/08/2026
Apache InLong: Non-template responsible persons can view template information
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732