CVE-2026-63038

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/issues/12135 .

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache InLong	>= 2.0.0, < 2.4.0

References

https://lists.apache.org/thread/79w0cfnkhs3hctv8yn861qx3qwlc3p37Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/12Mailing List, Third Party Advisory

Timeline

Published: Aug 20, 2026
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker CVE-2026-63048.3Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to po CVE-2026-630408.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authen CVE-2026-630418.8Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privi CVE-2026-630428.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create,CVE-2026-630437.5Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLon CVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Man CVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo CVE-2026-630468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleM CVE-2026-630477.5Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension CVE-2026-630489.4Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Pa CVE-2026-63058.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox