CVE-2026-63040: Apache InLong: Missing authorization in StreamSource forceDelete
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12145 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Apache InLong user can exploit it because StreamSource forceDelete performs no authorization check.
What is the potential impact?
An authenticated user can logically delete all stream sources, not only sources they are authorized to manage.
Which versions are affected and how should they be remediated?
Apache InLong versions from 2.0.0 before 2.4.0 are affected. Upgrade to 2.4.0 or cherry-pick the referenced fix.