Vulnerabilities

TI-2026-45022 CVE-2026-63046 · GHSA-jc7r-r7p4-f656

Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials

MEDIUM 41

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00675 Published 2026-08-21 Fixed in 2.4.0 CWE-88

TI-2026-45020 CVE-2026-63044 · GHSA-qvfh-v498-xrrf

Apache InLong: Authenticated SSRF via POST /api/node/testConnection

LOW 25

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00504 Published 2026-08-20 Fixed in 2.4.0 CWE-918

TI-2026-45019 CVE-2026-63043 · GHSA-834h-qg75-5mr8

Apache InLong: Agent path traversal via unvalidated file source path

MEDIUM 40

Relative Path Traversal vulnerability in Apache InLong.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00808 Published 2026-08-20 Fixed in 2.4.0 CWE-23

TI-2026-45018 CVE-2026-63042 · GHSA-jmq8-hg35-36h2

Apache InLong: Missing authorization on DataNode management endpoints

LOW 36

Files or Directories Accessible to External Parties vulnerability in Apache InLong.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00644 Published 2026-08-20 Fixed in 2.4.0 CWE-552

TI-2026-45016 CVE-2026-63040 · GHSA-3q63-2qmj-vfp6

Apache InLong: Missing authorization in StreamSource forceDelete

LOW 36

Files or Directories Accessible to External Parties vulnerability in Apache InLong.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00644 Published 2026-08-20 Fixed in 2.4.0 CWE-552

TI-2026-45015 CVE-2026-63039 · GHSA-pg4r-4hvf-4rqh

Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00686 Published 2026-08-20 Fixed in 2.4.0 CWE-89

TI-2026-45014 CVE-2026-63038 · GHSA-8x82-h8qj-qg8w

Apache InLong: SQL Injection via String Concatenation Vulnerability Report

MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00686 Published 2026-08-20 Fixed in 2.4.0 CWE-89

TI-2026-45013 CVE-2026-63037 · GHSA-3wj9-3gpr-q6vj

Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00686 Published 2026-08-20 Fixed in 2.4.0 CWE-89

TI-2026-45008 CVE-2026-63016 · GHSA-pr7c-fhx7-xrq6

Apache InLong: Ordinary users can create new packages

LOW 31

Uncontrolled Resource Consumption vulnerability in Apache InLong.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00634 Published 2026-08-20 Fixed in 2.4.0 CWE-400

TI-2026-45007 CVE-2026-63015 · GHSA-2wf7-pq8q-vp44

Apache InLong: Non-template responsible persons can view template information

LOW 21

Uncontrolled Resource Consumption vulnerability in Apache InLong.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00559 Published 2026-08-20 Fixed in 2.4.0 CWE-400

TI-2025-20360 CVE-2025-27531 · GHSA-62gc-8jr5-x9pm

Apache InLong: An arbitrary file read vulnerability for JDBC

MEDIUM 50

Deserialization of Untrusted Data vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00811 Published 2025-06-06 Fixed in 2.1.0 CWE-502

TI-2025-20359 CVE-2025-27528 · GHSA-98v7-xxxv-hcrh

Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00859 Published 2025-05-28 Fixed in 2.2.0 CWE-502

TI-2025-20358 CVE-2025-27526 · GHSA-532x-j9r7-8f73

Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass

LOW 30

Deserialization of Untrusted Data vulnerability in Apache InLong.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00856 Published 2025-05-28 Fixed in 2.2.0 CWE-502

TI-2025-20354 CVE-2025-27522 · GHSA-r324-vgr5-73c9

Apache InLong: JDBC Vulnerability during verification processing

LOW 31

Deserialization of Untrusted Data vulnerability in Apache InLong.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00899 Published 2025-05-28 Fixed in 2.2.0 CWE-502

TI-2024-24087 CVE-2024-36268 · GHSA-qff2-8qw7-hcvw

Apache InLong TubeMQ Client: Remote Code Execution vulnerability

MEDIUM 45

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01173 Published 2024-08-02 Fixed in 1.13.0 CWE-94

TI-2024-17464 CVE-2024-26579 · GHSA-fgh3-pwmp-3qw3

Apache Inlong JDBC Vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using malicious parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01139 Published 2024-05-08 Fixed in 1.12.0 CWE-502

TI-2024-17465 CVE-2024-26580 · GHSA-p2gx-4434-pf6g

Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0122 Published 2024-03-06 Fixed in 1.11.0 CWE-502

TI-2023-28411 CVE-2023-51784 · GHSA-9xg9-hh45-xcm6

Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager

MEDIUM 52

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0162 Published 2024-01-03 Fixed in 1.10.0 CWE-94

TI-2023-28412 CVE-2023-51785 · GHSA-crwj-2r3c-gx2g

Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager

MEDIUM 41

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01012 Published 2024-01-03 Fixed in 1.10.0 CWE-502

TI-2023-24854 CVE-2023-46227 · GHSA-jj32-3pf5-5mv5

Apache inlong has an Arbitrary File Read Vulnerability

MEDIUM 42

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01372 Published 2023-10-19 Fixed in 1.9.0 CWE-502

TI-2023-23391 CVE-2023-43666 · GHSA-wj6q-chpv-mcrx

Apache InLong: General user Unauthorized access User Management

LOW 30

Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00616 Published 2023-10-16 Fixed in 1.9.0 CWE-345

TI-2023-23392 CVE-2023-43667 · GHSA-fpcf-qr79-hjqp

Apache InLong: Log Injection in Global functions

MEDIUM 42

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create mislea…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0171 Published 2023-10-16 Fixed in 1.8.0 CWE-74

TI-2023-23393 CVE-2023-43668 · GHSA-rp6x-ggw6-8g56

Apache InLong: Jdbc Connection Security Bypass in InLong

MEDIUM 52

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0143 Published 2023-10-16 Fixed in 1.9.0 CWE-639

TI-2023-17558 CVE-2023-35088 · GHSA-r5pv-7g89-cxmc

Apache InLong: SQL injection in audit endpoint

MEDIUM 52

Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01643 Published 2023-07-25 Fixed in 1.8.0 CWE-89

TI-2023-17260 CVE-2023-34434 · GHSA-pq67-9jf9-hc3c

Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param

MEDIUM 42

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01701 Published 2023-07-25 Fixed in 1.8.0 CWE-502

Vulnerabilities

Filters