CVE-2026-40563
published 2026-05-04CVE-2026-40563: Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts…
PriorityP352high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.46%
37.3th percentile
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | atlas | >= 0.8 < 2.5.0 | 2.5.0 |
| apache_software_foundation | apache_atlas | 0.8 – 2.4.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Atlas has a Code Injection Vulnerability
ghsa·2026-05-04
CVE-2026-40563 [HIGH] CWE-94 Apache Atlas has a Code Injection Vulnerability
Apache Atlas has a Code Injection Vulnerability
### Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas.
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data.
### Affected Version:
This issue affects Apache Atlas: from 0.8-incubating through 2.4.0.
For affected versions >= 2.0.0, the vulnerability is only exploitable when Atlas is deployed with below non-default configuration.
`atlas.dsl.executor.traversal=false`
### Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
GHSA
GHSA-35xx-9xrg-gwhf: Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that a
ghsa_unreviewed·2026-05-04
CVE-2026-40563 [HIGH] CWE-94 GHSA-35xx-9xrg-gwhf: Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that a
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-04
Published