EXECUTIVE SUMMARY:
Multiple security vulnerabilities affecting Apache InLong versions All three flaws affect Apache InLong from 2 have been identified in Apache InLong from which expose internal data and systems to attackers. These flaws can be exploited through SQL injection, path traversal, or authenticated SSRF attacks.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security vulnerabilities affecting Apache InLong versions All three flaws affect Apache InLong from 2 have been identified in Apache InLong from which expose internal data and systems to attackers. These flaws can be exploited through SQL injection, path traversal, or authenticated SSRF attacks.[emaillocker id="1283"]
CVE-2026-63038 (CVSS 7.5 — High): An attacker can inject SQL through the dbName, tableName, schemaName, and username parameters.
CVE-2026-63043 (CVSS 7.7 —High): This flaw sits in the Agent file source path; an attacker can read arbitrary files from the Agent host because the path is not validated.
CVE-2026-63044 (CVSS 7.8 — High): Any authenticated user can abuse a test-connection endpoint to make outbound requests to internal hosts and ports.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/apache-inlong-sql-injection-cve-2026-63038/