CVE-2026-63042: Apache InLong: Missing authorization on DataNode management endpoints
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12161 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user who can authenticate to the Apache InLong manager can exploit it. The issue does not require administrative authorization for Data Node management actions.
What actions could an affected user perform?
An authenticated manager user can create, modify, and delete Data Node definitions.
Which Apache InLong versions are affected?
Apache InLong versions from 2.0.0 before 2.4.0 are affected.
What should teams do if they cannot immediately upgrade?
Cherry-pick the referenced fix, PR 12161. Until remediation is applied, limit manager authentication access to trusted users because any authenticated user can manage Data Node definitions.