CVE-2026-63042 in InLong
Summary
by MITRE • 08/20/2026
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12161 .
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Apache InLong versions from 2.0.0 up to but not including 2.4.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-552 as Files or Directories Accessible by an Unauthorized Actor. This flaw allows any authenticated user within the system to perform destructive actions on Data Node definitions without appropriate authorization checks. In enterprise data integration platforms like Apache InLong, which serves as a unified data integration solution for batch and streaming data, the integrity of configuration metadata is paramount. The ability to create, modify, or delete these definitions effectively grants an attacker control over how data flows through the system, potentially leading to significant operational disruptions or security breaches depending on the downstream systems involved.
From a technical perspective, this vulnerability stems from insufficient validation of user permissions when handling requests related to Data Node management. While authentication ensures that only logged-in users can access certain parts of the manager interface, authorization logic fails to restrict these high-privilege operations to administrators or specific roles with explicit permission sets. Consequently, any valid credential pair becomes a vector for privilege escalation in terms of operational impact. An attacker who obtains low-level credentials could escalate their influence by altering Data Node configurations, which may redirect data streams to malicious endpoints, delete critical connection definitions causing service outages, or inject malformed configuration that destabilizes the cluster components relying on these nodes.
The operational impact extends beyond simple configuration changes because Apache InLong often serves as a backbone for real-time and batch processing pipelines in large-scale environments. Disruption of Data Node definitions can lead to data loss if ingestion tasks fail silently or redirect sensitive information to unauthorized storage locations. Furthermore, the ability to delete existing configurations may cause cascading failures across dependent services that rely on stable connection endpoints. This aligns with ATT&CK technique T1562, Impair Defenses, as attackers could disable monitoring or logging capabilities by manipulating underlying infrastructure definitions before executing more direct attacks such as data exfiltration via T1048.
To mitigate this risk, organizations running affected versions must prioritize upgrading to Apache InLong version 2.4.0 or later immediately upon availability. For environments where immediate upgrades are not feasible due to compatibility constraints or testing requirements, applying the specific patch referenced in pull request number 12161 from the official Apache GitHub repository is recommended as a temporary remediation step. Additionally, implementing strict role-based access control policies within the InLong manager interface can help enforce least privilege principles even if underlying code vulnerabilities persist until full migration occurs. Regular auditing of user permissions and monitoring for unusual configuration changes are also advised to detect potential exploitation attempts early in the kill chain.