CVE-2026-63040— Apache InLong: Missing authorization in StreamSource forceDelete
Quick assessment
Affected
Apache Software Foundation Apache InLong
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache InLong 中存在允许外部用户访问文件或目录的安全漏洞。 未执行任何授权检查，导致任何已认证的用户都可以逻辑删除所有的数据源（Stream Sources）。 此漏洞影响 Apache InLong 2.0.0 至 2.4.0（不含 2.4.0）版本。 建议用户升级至 Apache InLong 2.4.0 版本，或通过应用补丁 [1] 解决该问题： [1] https://github.com/apache/inlong/pull/12145
Possible ATT&CK Techniques 2 AI
T1136 · Create Account T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0< 2.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63040
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache InLong: Missing authorization in StreamSource forceDelete
Source: CVE Program / CVE List V5
Vulnerability Description
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12145 .
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-63040
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63040
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-63040 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-20 · 9 CVEs total
| CVE-2026-63044 | Apache InLong: Authenticated SSRF via POST /api/node/testConnection | |
| CVE-2026-63043 | Apache InLong: Agent path traversal via unvalidated file source path | |
| CVE-2026-63042 | Apache InLong: Missing authorization on DataNode management endpoints | |
| CVE-2026-63039 | Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAle | |
| CVE-2026-63038 | Apache InLong: SQL Injection via String Concatenation Vulnerability Report | |
| CVE-2026-63037 | Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endp | |
| CVE-2026-63016 | Apache InLong: Ordinary users can create new packages | |
| CVE-2026-63015 | Apache InLong: Non-template responsible persons can view template information |
IV. Related Vulnerabilities
Same product: Apache InLong
-
CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi -
CVE-2026-63044
Apache InLong: Authenticated SSRF via POST /api/node/testCon -
CVE-2026-63043
Apache InLong: Agent path traversal via unvalidated file sou -
CVE-2026-63042
Apache InLong: Missing authorization on DataNode management -
CVE-2026-63039
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-
Same vendor: Apache Software Foundation
-
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure -
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the und -
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch -
CVE-2026-63621
Apache Camel: Camel-Knative: CloudEvent extension fields rec -
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat
Same weakness: CWE-552
-
CVE-2026-78051
alexta69 MeTube Cookie File cookies.txt file access -
CVE-2026-54457
TensorZero: Arbitrary file read and SSRF in TensorZero Gatew -
CVE-2026-63042
Apache InLong: Missing authorization on DataNode management -
CVE-2026-76799
code-projects Login Registration System SQL Database Backup -
CVE-2026-19903
SourceCodester Online Clothing Store SQL Database Backup sho
V. Comments for CVE-2026-63040
No comments yet