CVE-2026-63042

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12161 .

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/15	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Archivos o Directorios Accesibles a Partes Externas en Apache InLong. Cualquier usuario que pueda autenticarse en el gestor puede crear, modificar y eliminar definiciones de nodos de datos. Este problema afecta a Apache InLong: desde 2.0.0 antes de 2.4.0. Se aconseja a los usuarios que actualicen a la versión 2.4.0 de Apache InLong o apliquen el cherry-pick [1] para solucionarlo. [1] HTTPS://github.com/apache/inlong/pull/12161 .

Information

Published : 2026-08-20 16:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-63042

Mitre link : CVE-2026-63042

CVE.ORG link : CVE-2026-63042

JSON object : View

Products Affected

apache

inlong

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2026-63042", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63042", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T16:57:03.954762Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache InLong", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T16:17:30.163", "references": [{"url": "https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/20/15", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12161 ."}, {"lang": "es", "value": "Vulnerabilidad de Archivos o Directorios Accesibles a Partes Externas en Apache InLong. Cualquier usuario que pueda autenticarse en el gestor puede crear, modificar y eliminar definiciones de nodos de datos.\n\nEste problema afecta a Apache InLong: desde 2.0.0 antes de 2.4.0.\n\nSe aconseja a los usuarios que actualicen a la versi\u00f3n 2.4.0 de Apache InLong o apliquen el cherry-pick [1] para solucionarlo.\n\n[1] HTTPS://github.com/apache/inlong/pull/12161 ."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A21FED1B-A1E2-4CF8-88D4-A020ADBCA50F", "versionEndExcluding": "2.4.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}