CVE-2026-63044: Apache InLong: Authenticated SSRF via POST /api/node/testConnection
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12130 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Patch https://github.com/apache/inlong/pull/12130
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Apache InLong user can exploit it; administrator privileges are not required. The affected endpoint is POST /api/node/testConnection.
What access does an attacker gain through exploitation?
An attacker can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This can expose services reachable from the Manager server that are not directly reachable by the attacker.
Which versions are affected and what is the remediation?
Apache InLong versions from 2.0.0 before 2.4.0 are affected. Upgrade to version 2.4.0 or cherry-pick the referenced fix.