Apache Inlong vulnerabilities

CVE-2026-63043 [HIGH] CWE-23 CVE-2026-63043: Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host file Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12146 .

CVE-2023-31066 [CRITICAL] CWE-552 CVE-2023-31066: Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apac Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlon

CVE-2023-34434 [HIGH] CWE-502 CVE-2023-34434: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This iss Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/

CVE-2023-51785 [HIGH] CWE-502 CVE-2023-51785: Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: f Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9331

CVE-2023-43667 [HIGH] CWE-74 CVE-2023-43667: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') v Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1

CVE-2023-46227 [HIGH] CWE-502 CVE-2023-46227: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814

CVE-2023-31206 [HIGH] CWE-668 CVE-2023-31206: Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://cveprocess.apache.org/cve5/[1]%

CVE-2023-31058 [HIGH] CWE-502 CVE-2023-31058: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This iss Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674 https://

CVE-2023-31454 [HIGH] CWE-732 CVE-2023-31454: Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Ap Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1] https://github.com

CVE-2023-31453 [HIGH] CWE-732 CVE-2023-31453: Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Ap Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] t

CVE-2023-31103 [HIGH] CWE-668 CVE-2023-31103: Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 https://github.c

CVE-2023-31064 [HIGH] CWE-552 CVE-2023-31064: Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apac Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7

CVE-2023-24977 [HIGH] CWE-125 CVE-2023-24977: Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apac Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 https://github.com/apache/inlong/pull/7214 to solve it.

CVE-2023-34189 [MEDIUM] CWE-668 CVE-2023-34189: Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://gi

CVE-2025-27522 [MEDIUM] CVE-2025-27522: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732

CVE-2025-27526 [MEDIUM] CWE-502 CVE-2025-27526: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

CVE-2023-43666 [MEDIUM] CWE-345 CVE-2023-43666: Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apa Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8623

CVE-2023-31101 [MEDIUM] CWE-1188 CVE-2023-31101: Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLon Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 htt

CVE-2026-63044 [MEDIUM] CWE-918 CVE-2026-63044: Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.

CVE-2023-30465 [MEDIUM] CWE-89 CVE-2023-30465: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the usernam