https://seclists.org/oss-sec/2026/q3/533: CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability port

Q: Which deployments should be prioritized for remediation?

Prioritize Apache InLong deployments running versions 2.0.0 through versions before 2.4.0, especially where untrusted users or systems can supply dbName, tableName, schemaName, or username values.

Q: What level of access does an attacker need?

An attacker needs the ability to control one or more of the affected dbName, tableName, schemaName, or username parameters. The vulnerability permits arbitrary SQL code injection through those parameters.

Q: What can be done if an immediate upgrade is not possible?

Upgrade to Apache InLong 2.4.0 when possible. As an alternative, the advisory states that users can cherry-pick the fix referenced in Apache InLong issue 12135.

Q: How can I identify potentially affected instances?

Check the installed Apache InLong version. Versions starting at 2.0.0 and earlier than 2.4.0 are affected; also identify integrations or interfaces that populate the affected database, table, schema, or username parameters.

Published Aug 20, 2026

Updated

Affected Software

1 affected component

Apache Inlong>2.0.0<=2.4.0

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Prioritize Apache InLong deployments running versions 2.0.0 through versions before 2.4.0, especially where untrusted users or systems can supply dbName, tableName, schemaName, or username values.

What level of access does an attacker need?

An attacker needs the ability to control one or more of the affected dbName, tableName, schemaName, or username parameters. The vulnerability permits arbitrary SQL code injection through those parameters.

What can be done if an immediate upgrade is not possible?

Upgrade to Apache InLong 2.4.0 when possible. As an alternative, the advisory states that users can cherry-pick the fix referenced in Apache InLong issue 12135.

How can I identify potentially affected instances?

Check the installed Apache InLong version. Versions starting at 2.0.0 and earlier than 2.4.0 are affected; also identify integrations or interfaces that populate the affected database, table, schema, or username parameters.