https://seclists.org/oss-sec/2026/q3/532: CVE-2026-63037: Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Q: Which deployments are affected?

Apache InLong versions from 2.0.0 up to, but not including, 2.4.0 are affected. The issue is in the Manager backend database path used by the OpenAPI audit alert rule list endpoint.

Q: Does an attacker need to authenticate?

No. The affected endpoint is described as unauthenticated, so an attacker who can reach it may be able to target the SQL injection flaw in the ORDER BY clause.

Q: What should I do if my deployment is affected?

Upgrade Apache InLong to version 2.4.0. If upgrading is not immediately possible, cherry-pick the referenced fix from Apache InLong issue 12079.

Published Aug 20, 2026

Updated

Affected Software

1 affected component

Apache Inlong>=2.0.0<2.4.0

Frequently Asked Questions

Which deployments are affected?

Apache InLong versions from 2.0.0 up to, but not including, 2.4.0 are affected. The issue is in the Manager backend database path used by the OpenAPI audit alert rule list endpoint.

Does an attacker need to authenticate?

No. The affected endpoint is described as unauthenticated, so an attacker who can reach it may be able to target the SQL injection flaw in the ORDER BY clause.

What should I do if my deployment is affected?

Upgrade Apache InLong to version 2.4.0. If upgrading is not immediately possible, cherry-pick the referenced fix from Apache InLong issue 12079.