CVE-2026-63046— Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Quick assessment
Affected
Apache Software Foundation Apache InLong
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache InLong 中存在一处“命令参数分隔符处理不当（参数注入）”漏洞。Agent Installer 的 ModuleManager 模块通过 执行任意 Shell 命令时，未进行任何过滤或白名单验证。 此问题影响 Apache InLong 2.0.0 至 2.4.0（不含）版本。 建议用户升级至 Apache InLong 2.4.0 版本，或应用补丁 [1]/[2] 以解决该问题。 [1] https://github.com/apache/inlong/pull/12151 [2] https:
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0< 2.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63046
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell
commands via ExcuteLinux.exeCmd() with no filtering or whitelist
validation.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.
[1] https://github.com/apache/inlong/pull/12151 .
[2] https://github.com/apache/inlong/pull/12155 .
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache InLong | 2.0.0 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-63046
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63046
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-63046 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-21 · 21 CVEs total
| CVE-2026-59654 | 6.8 MEDIUM | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-61398 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Fun | |
| CVE-2026-68745 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP | |
| CVE-2026-66797 | Apache CloudStack: Unauthorised comment creation and disclosure | |
| CVE-2026-66722 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | |
| CVE-2026-66721 | Apache CloudStack: Authorization issue with listHostTags for domain admins | |
| CVE-2026-65613 | Apache CloudStack: Webhook Deliveries Incorrect Access | |
| CVE-2026-62440 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulatio | |
| CVE-2026-61422 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | |
| CVE-2026-61400 | Apache CloudStack: Get and Run Diagnostics Command Injection | |
| CVE-2026-61399 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | |
| CVE-2026-61397 | Apache CloudStack: OAuth2 Token Cross-Request Leak | |
| CVE-2026-59799 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | |
| CVE-2026-59780 | Apache CloudStack: LDAP provider configuration disclosure | |
| CVE-2026-59657 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob | |
| CVE-2026-59655 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | |
| CVE-2026-59085 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | |
| CVE-2026-50222 | Apache CloudStack: Improper access control in Userdata reference APIs | |
| CVE-2026-50112 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | |
| CVE-2026-47359 | Apache CloudStack: OS Command Injection due to unsanitized mount command |
IV. Related Vulnerabilities
Same product: Apache InLong
-
CVE-2026-63044
Apache InLong: Authenticated SSRF via POST /api/node/testCon -
CVE-2026-63043
Apache InLong: Agent path traversal via unvalidated file sou -
CVE-2026-63042
Apache InLong: Missing authorization on DataNode management -
CVE-2026-63040
Apache InLong: Missing authorization in StreamSource forceDe -
CVE-2026-63039
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-
Same vendor: Apache Software Foundation
-
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp -
CVE-2026-66422
Apache Tomcat: Servlet role references can bypass declarativ
Same weakness: CWE-88
-
CVE-2026-79675
NLTK before 3.10.3 JVM Argument Injection via Per-Call Optio -
CVE-2026-78637
Fdawgs node-poppler Argument Injection index.js pdfUnite arg -
CVE-2026-78678
GitPython before 3.1.59 Arbitrary File Read via Repo.blame() -
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Inj -
CVE-2026-68766
hashcat through 7.1.2 Arbitrary File Write via Restore File
V. Comments for CVE-2026-63046
No comments yet