CVE-2026-63046: Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it.
[1] https://github.com/apache/inlong/pull/12151 .
[2] https://github.com/apache/inlong/pull/12155 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache InLongto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch pull/12151 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch pull/12155
Event History
Frequently Asked Questions
Which deployments are affected?
Apache InLong Agent Installer versions from 2.0.0 up to, but not including, 2.4.0 are affected.
What does an attacker need to exploit this issue?
The available information identifies command execution through the Agent Installer's ModuleManager and references default credentials in the vulnerability title. It does not specify the required network access, authentication path, or exact default credentials.
What is the impact of successful exploitation?
An attacker can cause ModuleManager to execute arbitrary shell commands through ExcuteLinux.exeCmd(), resulting in remote code execution.
How can this be remediated?
Upgrade Apache InLong to version 2.4.0. The advisory also identifies the changes in pull requests 12151 and 12155 as cherry-pick options.