CVE-2026-63046highCWE-88

CVE-2026-63046: falha de alta gravidade em Apache InLong

Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials

Publicada em

Seguir esta CVE+ Monitorar Apache InLong

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it. [1]  https://github.com/apache/inlong/pull/12151 . [2]  https://github.com/apache/inlong/pull/12155 .
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache InLong
CVEs relacionadas — Apache InLong

No mesmo produto, das mais perigosas para as menos.

CVE-2022-40955HIGHDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCEPSS 2.7%CVE-2023-43667HIGHApache InLong: Log Injection in Global functionsEPSS 1.7%CVE-2023-34434HIGHApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramEPSS 1.7%CVE-2023-35088CRITICALApache InLong: SQL injection in audit endpointEPSS 1.6%CVE-2023-51784CRITICALApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerEPSS 1.6%CVE-2023-27296HIGHApache InLong: JDBC Deserialization Vulnerability in InLongEPSS 1.5%