CVE-2026-63044 in InLong
Summary
by MITRE • 08/20/2026
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12130 .
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability represents a critical Server-Side Request Forgery flaw within the Apache InLong Manager component, specifically affecting versions ranging from 2.0.0 up to but not including version 2.4.0. This security defect allows any authenticated user, regardless of whether they possess administrative privileges or elevated roles, to manipulate the server into initiating outbound network connections to arbitrary destinations. The core technical flaw lies in the insufficient validation and sanitization of input parameters that dictate target URLs or host addresses for internal services managed by InLong Manager. When a user provides a maliciously crafted endpoint, the backend logic fails to enforce strict allowlists on destination IP ranges, domain names, or protocols, thereby enabling the server to act as an open proxy or pivot point for network reconnaissance and data exfiltration from within the protected infrastructure.
From an operational perspective, this vulnerability poses severe risks to internal network security posture. An attacker with valid credentials can leverage this flaw to perform port scanning of internal services that are not exposed to the public internet, potentially identifying vulnerable legacy systems, database instances, or management interfaces residing on private subnets. Furthermore, the ability to make arbitrary HTTP requests facilitates attacks against cloud metadata endpoints, such as those found in AWS EC2 or Azure Managed Identity environments, which could lead to credential theft and subsequent full compromise of cloud resources. The lack of role-based restrictions means that even low-privilege users can execute these actions, significantly expanding the attack surface compared to vulnerabilities requiring admin access.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-918, which defines Server-Side Request Forgery as a flaw where a web application fetches a remote resource without validating the user-supplied URL. In terms of offensive security tactics, this behavior maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer variants that utilize server-side requests for internal network mapping and credential harvesting. The exploitation path typically involves crafting a request with a target address pointing to an internal service, such as 127.0.0.1 or private IP ranges like 192.168.x.x, bypassing standard perimeter defenses since the traffic originates from within the trusted network zone.
To mitigate this risk and restore secure operations, organizations running affected versions of Apache InLong must immediately upgrade to version 2.4.0 or later, which incorporates the necessary input validation fixes. For environments where an immediate upgrade is not feasible due to compatibility constraints, administrators should apply the specific patch referenced in pull request number 12130 from the official Apache InLong GitHub repository. Additionally, as a defensive measure while patches are being deployed, network segmentation strategies and egress filtering rules should be reviewed to restrict outbound connections from the InLong Manager host to only those destinations strictly required for business functionality, thereby limiting the blast radius of any successful exploitation attempt.