CVE-2026-40563— Apache Atlas: Script injection allows access to unintended data
Quick assessment
Affected
Apache Software Foundation Apache Atlas
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Atlas是美国阿帕奇（Apache）基金会的一套可伸缩和可扩展的核心功能治理服务。 Apache Atlas 0.8版本至2.4.0版本存在代码注入漏洞，该漏洞源于DSL搜索端点接受用户提供的查询字符串，可能导致攻击者修改Gremlin遍历逻辑以访问未授权数据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Atlas | 0.8≤ 2.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40563
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Atlas: Script injection allows access to unintended data
Source: CVE Program / CVE List V5
Vulnerability Description
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Atlas 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Atlas是美国阿帕奇（Apache）基金会的一套可伸缩和可扩展的核心功能治理服务。 Apache Atlas 0.8版本至2.4.0版本存在代码注入漏洞，该漏洞源于DSL搜索端点接受用户提供的查询字符串，可能导致攻击者修改Gremlin遍历逻辑以访问未授权数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Atlas | 0.8 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-40563
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40563
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-40563 (1)
Same Patch Batch · Apache Software Foundation · 2026-05-04 · 17 CVEs total
| CVE-2026-42810 | 9.9 CRITICAL | Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or |
| CVE-2026-42811 | 9.9 CRITICAL | Apache Polaris: could broaden vended GCS credentials through unescaped identifier content |
| CVE-2026-42809 | 9.9 CRITICAL | Apache Polaris: staged table creation could vend storage credentials for unvalidated locat |
| CVE-2026-42812 | 9.9 CRITICAL | Apache Polaris: No protection on `write.metadata.path` |
| CVE-2026-40682 | Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor | |
| CVE-2026-42027 | Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader | |
| CVE-2026-42440 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader | |
| CVE-2026-29169 | Apache HTTP Server: mod_dav_lock indirect lock crash | |
| CVE-2026-23918 | Apache HTTP Server: http2: double free and possible RCE on early reset | |
| CVE-2026-33006 | Apache HTTP Server: mod_auth_digest timing attack | |
| CVE-2026-33007 | Apache HTTP Server: mod_authn_socache crash | |
| CVE-2026-33523 | Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status | |
| CVE-2026-33857 | Apache HTTP Server: Off-by-one OOB reads in AJP getter functions | |
| CVE-2026-34032 | Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination C | |
| CVE-2026-34059 | Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data | |
| CVE-2026-24072 | Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr |
IV. Related Vulnerabilities
Same product: Apache Atlas
-
CVE-2026-50622
Apache Atlas: Missing Authorization on Admin Endpoints -
CVE-2025-62198
Apache Atlas: Stored XSS in Create Entity page -
CVE-2024-46910
Apache Atlas: An authenticated user can perform XSS and pote -
CVE-2022-34271
Apache Atlas: zip path traversal in import functionality -
CVE-2020-13928
Apache Atlas 跨站脚本漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue -
CVE-2026-94269
Apache APISIX: Servlet-style normalization creates a route/u -
CVE-2026-94250
Apache APISIX: Batch response aggregation can exhaust worker -
CVE-2026-94220
Apache APISIX: session fixation issue in feishu-auth and din -
CVE-2026-94212
Apache APISIX: unauthenticated impersonation issue in saml-a
Same weakness: CWE-94
-
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitr -
CVE-2026-102130
Kiteworks Email Protection Gateway Remote Code Execution -
CVE-2026-102131
Kiteworks Email Protection Gateway Improper Handling of Case -
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host -
CVE-2026-96349
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution
V. Comments for CVE-2026-40563
No comments yet