CVE-2026-40563 in Atlas
Summary
by MITRE • 05/04/2026
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.
atlas.dsl.executor.traversal=false
Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability described represents a critical improper control of generation of code weakness that fundamentally undermines the security posture of Apache Atlas deployments. This issue manifests through the DSL search endpoint which processes user-supplied query strings without adequate sanitization or validation of the Gremlin traversal logic. The flaw allows attackers to manipulate the grammar-allowed characters within the traversal language to inject unintended operations that can bypass normal access controls and retrieve unauthorized data. This vulnerability falls under CWE-94, which specifically addresses the improper control of generation of code, and aligns with ATT&CK technique T1059.007 for execution through scripting languages. The impact extends across all versions from 0.8 through 2.4.0, with the severity being particularly pronounced in deployments where the non-default configuration parameter atlas.dsl.executor.traversal is set to false, indicating that the vulnerability is not automatically present in all installations but requires specific deployment conditions to manifest.
The technical exploitation of this vulnerability occurs through manipulation of the Gremlin traversal language syntax within the DSL search endpoint. Attackers can craft malicious query strings that leverage the allowed character set to alter the intended traversal logic and access data that should otherwise be restricted. This type of code injection allows for unauthorized data access and potentially full system compromise depending on the privileges of the Atlas service account. The vulnerability represents a classic case of insufficient input validation where user-supplied content is directly incorporated into the execution path without proper sanitization. The specific configuration requirement for versions >= 2.0 adds complexity to the attack surface since administrators must be aware of this non-default setting to properly assess their risk exposure. This weakness enables attackers to perform unauthorized data retrieval operations that bypass normal access control mechanisms and could lead to data breaches or information disclosure.
The operational impact of this vulnerability extends beyond simple data access violations to encompass potential system compromise and data exfiltration capabilities. When exploited successfully, attackers can retrieve sensitive metadata, entity information, and relationship data that forms the core of Atlas's functionality. The implications are particularly severe for organizations that rely on Atlas for catalog management, lineage tracking, or governance operations since the compromised data could include business-critical information about data assets, their relationships, and access patterns. The vulnerability's presence in multiple versions from 0.8 through 2.4.0 indicates a prolonged period where organizations were exposed to this risk without proper mitigation. Security teams must consider this vulnerability as part of their broader threat landscape assessment and ensure that all Atlas deployments are properly updated to version 2.5.0 or later to eliminate the code injection vector.
The recommended mitigation strategy focuses on upgrading to Apache Atlas version 2.5.0 which contains the necessary fixes to address the code injection vulnerability. This upgrade path represents the primary defense mechanism against exploitation and should be prioritized across all affected deployments. Organizations should also conduct thorough assessments of their current Atlas configurations to identify deployments where the non-default parameter atlas.dsl.executor.traversal is set to false, as these installations require special attention to ensure proper security controls are in place. Additional defensive measures may include implementing network segmentation, monitoring for unusual query patterns, and establishing proper access controls around the DSL endpoints. The vulnerability serves as a reminder of the importance of validating and sanitizing all user-supplied input in systems that process structured query languages and highlights the need for robust security testing of data access APIs.