CVE-2026-63037: Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/issues/12079 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Which Apache InLong deployments are affected?
Apache InLong versions from 2.0.0 up to, but not including, 2.4.0 are affected.
Does exploitation require authentication?
No. The issue is described as unauthenticated, affecting the Manager OpenAPI audit alert rule list endpoint.
What should teams do if they are running an affected version?
Upgrade Apache InLong to version 2.4.0. If an upgrade is not immediately possible, cherry-pick the referenced fix from Apache InLong issue 12079.
How can teams determine whether they may be exposed?
Identify the deployed Apache InLong version and whether the Manager OpenAPI audit alert rule list endpoint is reachable. Deployments in the affected version range should be treated as vulnerable.