CVE-2026-63040

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12145 .

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache InLong	>= 2.0.0, < 2.4.0

References

https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offyMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/14Mailing List, Third Party Advisory

Timeline

Published: Aug 20, 2026
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630418.8Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privi CVE-2026-630428.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create,CVE-2026-630437.5Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLon CVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Man CVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo CVE-2026-630468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleM CVE-2026-630477.5Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension CVE-2026-630489.4Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Pa CVE-2026-63058.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-63068.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-63078.8Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-630719.8Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations