CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/issues/12135 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch https://github.com/apache/inlong/issues/12135 .
Event History
Frequently Asked Questions
Which Apache InLong deployments are affected?
Apache InLong versions from 2.0.0 up to, but not including, 2.4.0 are affected.
Which inputs can be used to inject SQL?
The vulnerable parameters are dbName, tableName, schemaName, and username. An attacker able to supply crafted values through these parameters can inject arbitrary SQL code.
What should teams do if they cannot immediately upgrade?
Upgrade to Apache InLong 2.4.0. If upgrading is not immediately possible, cherry-pick the fix referenced in Apache InLong issue 12135.