CVE-2026-63042

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12161 .

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache InLong	>= 2.0.0, < 2.4.0

References

https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/15Mailing List, Third Party Advisory

Timeline

Published: Aug 20, 2026
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630437.5Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLon CVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Man CVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo CVE-2026-630468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleM CVE-2026-630477.5Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension CVE-2026-630489.4Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Pa CVE-2026-63058.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-63068.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-63078.8Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-630719.8Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations CVE-2026-630727.5Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwr CVE-2026-630739.8Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR