CVE-2026-63040CWE-552

CVE-2026-63040

High · published August 20, 2026

CVSS v3.1

8.1

EPSS

Percentile

50.2

In the wild

Unconfirmed

What it is

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12145 .

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00644 · 50.2th percentile
Weakness: CWE-552 · Files or Directories Accessible to External Parties
Published: 2026-08-20T20:17Z

Affected products (1)

Product	Versions	Fixed in
apache/inlong	≥ 2.0.0, < 2.4.0	2.4.0

References (2)

https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offy · [email protected]http://www.openwall.com/lists/oss-security/2026/08/20/14 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

20 AUG 15:48Z
Apache InLong: Missing authorization in StreamSource forceDelete
cvelistv5