CVE-2026-40563

Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0. For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration. atlas.dsl.executor.traversal=false Mitigation: Users are recommended to upgrade to version 2.5.0, which fixes the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/03/9	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Descripción: Vulnerabilidad de control inadecuado de la generación de código (’Inyección de código’) en Apache Atlas Apache Atlas expone un endpoint de búsqueda DSL que acepta cadenas de consulta proporcionadas por el usuario. El atacante puede alterar la lógica de recorrido de Gremlin dentro de los caracteres permitidos por la gramática para acceder a datos no deseados. Versión afectada: Este problema afecta a Apache Atlas: desde la versión 0.8 hasta la 2.4.0. Para la versión afectada mayor o igual que 2.0, la vulnerabilidad solo existe cuando Atlas se despliega con la siguiente configuración no predeterminada. atlas.dsl.executor.traversal=false Mitigación: Se recomienda a los usuarios actualizar a la versión 2.5.0, que corrige el problema.

Information

Published : 2026-05-04 16:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-40563

Mitre link : CVE-2026-40563

CVE.ORG link : CVE-2026-40563

JSON object : View

Products Affected

apache

atlas

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-40563", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40563", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T03:56:07.820266Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Atlas", "versions": [{"status": "affected", "version": "0.8", "versionType": "semver", "lessThanOrEqual": "2.4.0"}], "packageName": "org.apache.atlas:atlas-repository", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-05-04T16:16:02.283", "references": [{"url": "https://lists.apache.org/thread/vd0oggmqxl2k1skm0z2f9p0plx7jhmfl", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/03/9", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Description:\nImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas\nApache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data\n\n\n\n\nAffect Version:\nThis issue affects Apache Atlas: from 0.8 through 2.4.0.\n\n\n\nFor the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.\n\n\natlas.dsl.executor.traversal=false\n\n\n\nMitigation:\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue."}, {"lang": "es", "value": "Descripci\u00f3n:\nVulnerabilidad de control inadecuado de la generaci\u00f3n de c\u00f3digo (\u2019Inyecci\u00f3n de c\u00f3digo\u2019) en Apache Atlas\nApache Atlas expone un endpoint de b\u00fasqueda DSL que acepta cadenas de consulta proporcionadas por el usuario. El atacante puede alterar la l\u00f3gica de recorrido de Gremlin dentro de los caracteres permitidos por la gram\u00e1tica para acceder a datos no deseados. Versi\u00f3n afectada:\nEste problema afecta a Apache Atlas: desde la versi\u00f3n 0.8 hasta la 2.4.0. Para la versi\u00f3n afectada mayor o igual que 2.0, la vulnerabilidad solo existe cuando Atlas se despliega con la siguiente configuraci\u00f3n no predeterminada. atlas.dsl.executor.traversal=false Mitigaci\u00f3n:\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.5.0, que corrige el problema."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:atlas:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60FA8FF5-6183-4E24-AD44-3D6D2E0FC66C", "versionEndExcluding": "2.5.0", "versionStartIncluding": "0.8"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}