CVE-2026-63042highCWE-552

CVE-2026-63042: high-severity vulnerability in Apache InLong

Apache InLong: Missing authorization on DataNode management endpoints

Published · Updated

Follow this CVE+ Monitor Apache InLong

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/12161 .
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
Apache Software Foundation · Apache InLong
Related CVEs — Apache InLong

In the same product, most dangerous first.

CVE-2022-40955HIGHDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCEPSS 2.7%CVE-2023-43667HIGHApache InLong: Log Injection in Global functionsEPSS 1.7%CVE-2023-34434HIGHApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramEPSS 1.7%CVE-2023-35088CRITICALApache InLong: SQL injection in audit endpointEPSS 1.6%CVE-2023-51784CRITICALApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerEPSS 1.6%CVE-2023-27296HIGHApache InLong: JDBC Deserialization Vulnerability in InLongEPSS 1.5%