CVE-2026-63042CWE-552

CVE-2026-63042

High · published August 20, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/12161 .

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.3th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-08-20T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/inlong≥ 2.0.0, < 2.4.02.4.0
References (2)
https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/20/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 AUG 15:50Z
    Apache InLong: Missing authorization on DataNode management endpoints
    cvelistv5