CVE-2026-63044CWE-918ssrf

CVE-2026-63044

Medium · published August 20, 2026

CVSS v3.1
5.4
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to

arbitrary internal hosts and ports.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/12130 .

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00504 · 42.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-20T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/inlong≥ 2.0.0, < 2.4.02.4.0
References (2)
https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/20/17 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 AUG 15:57Z
    Apache InLong: Authenticated SSRF via POST /api/node/testConnection
    cvelistv5