https://seclists.org/oss-sec/2026/q3/530: CVE-2026-63015: Apache InLong: Non-template sponsible persons can view template information

Q: Which Apache InLong deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. Version 2.4.0 is identified as the fixed release.

Q: What access does an attacker need?

The issue concerns users who are not designated as template responsible persons. Such users may be able to view template information they should not be authorized to access.

Q: What should teams do if they cannot immediately upgrade?

Upgrade to Apache InLong 2.4.0 when possible. As an alternative, the advisory states that the referenced change can be cherry-picked.

Published Aug 20, 2026

Updated

Affected Software

1 affected component

Apache Inlong>2.0.0<2.4.0

Frequently Asked Questions

Which Apache InLong deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. Version 2.4.0 is identified as the fixed release.

What access does an attacker need?

The issue concerns users who are not designated as template responsible persons. Such users may be able to view template information they should not be authorized to access.

What should teams do if they cannot immediately upgrade?

Upgrade to Apache InLong 2.4.0 when possible. As an alternative, the advisory states that the referenced change can be cherry-picked.