CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0

TL;DR

Apache InLong patched three flaws in version 2.4.0. The most notable is an Apache InLong SQL injection bug, CVE-2026-63038. The set also includes a path traversal flaw and an authenticated SSRF issue.

Why it matters

Apache InLong is an open-source data integration platform. Teams use it to move large data streams at scale. A flaw in its Manager service can expose internal data and systems.

How the attacks work

The three issues target different parts of the platform.

CVE-2026-63038: SQL injection

This is the headline flaw. The project describes it as an Apache InLong SQL injection issue caused by string concatenation. An attacker can inject SQL through the dbName, tableName, schemaName, and username parameters.

CVE-2026-63043: path traversal

This flaw sits in the Agent file source path. Because the path is not validated, an attacker can read arbitrary files from the Agent host.

CVE-2026-63044: authenticated SSRF

Here, any authenticated user can abuse a test-connection endpoint. No admin role is needed. The server then makes outbound requests to internal hosts and ports.

Affected versions

All three flaws affect Apache InLong from 2.0.0 before 2.4.0. The project rates each as important severity. No public exploitation or proof-of-concept has been confirmed for these bugs.

Patch and mitigation

Upgrade to Apache InLong 2.4.0. You can get it from the official InLong downloads page. Alternatively, teams can cherry-pick the upstream fixes listed in each advisory. Patching remains the safest fix for this Apache InLong SQL injection flaw and the two related issues.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.