CVE-2026-63037— Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0< 2.4.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63037
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/issues/12079 .
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0 ~ 2.4.0 | - |
II. Public POCs for CVE-2026-63037
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63037
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-63037 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-20 · 9 CVEs total
| CVE-2026-63044 | Apache InLong: Authenticated SSRF via POST /api/node/testConnection | |
| CVE-2026-63043 | Apache InLong: Agent path traversal via unvalidated file source path | |
| CVE-2026-63042 | Apache InLong: Missing authorization on DataNode management endpoints | |
| CVE-2026-63040 | Apache InLong: Missing authorization in StreamSource forceDelete | |
| CVE-2026-63039 | Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAle | |
| CVE-2026-63038 | Apache InLong: SQL Injection via String Concatenation Vulnerability Report | |
| CVE-2026-63016 | Apache InLong: Ordinary users can create new packages | |
| CVE-2026-63015 | Apache InLong: Non-template responsible persons can view template information |
IV. Related Vulnerabilities
Same product: Apache InLong
- CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi - CVE-2026-63044
Apache InLong: Authenticated SSRF via POST /api/node/testCon - CVE-2026-63043
Apache InLong: Agent path traversal via unvalidated file sou - CVE-2026-63042
Apache InLong: Missing authorization on DataNode management - CVE-2026-63040
Apache InLong: Missing authorization in StreamSource forceDe
Same vendor: Apache Software Foundation
- CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak - CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi - CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m - CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink - CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer
Same weakness: CWE-89
- CVE-2026-76904
GeoTools has unauthenticated SQL injection in the jsonArrayC - CVE-2026-76613
Joomla Extension - yootheme.com - Authenticated, privileged - CVE-2026-77392
SourceCodester Dynamic Input Field Generator Using HTML, CSS - CVE-2026-68782
Azure SQL Database Elevation of Privilege Vulnerability - CVE-2026-68789
Azure SQL Database Elevation of Privilege Vulnerability
V. Comments for CVE-2026-63037
No comments yet