https://seclists.org/oss-sec/2026/q3/536: CVE-2026-63042: Apache InLong: Missing authorization on DataNode management endpoints

Q: Who can exploit this issue?

Any user who can authenticate to the Apache InLong manager can exploit it. The issue is not limited to administrative users because the affected DataNode management endpoints lack authorization checks.

Q: Which deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. Version 2.4.0 is identified as the fixed release.

Q: What can an authenticated attacker do?

An authenticated manager user can create, modify, or delete DataNode definitions.

Q: What should organizations do if they cannot upgrade immediately?

The provided remediation options are to upgrade to Apache InLong 2.4.0 or cherry-pick the referenced fix. No other workaround is specified in the provided information.

Published Aug 20, 2026

Updated

Affected Software

1 affected component

Apache Inlong>=2.0.0<2.4.0

Frequently Asked Questions

Who can exploit this issue?

Any user who can authenticate to the Apache InLong manager can exploit it. The issue is not limited to administrative users because the affected DataNode management endpoints lack authorization checks.

Which deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. Version 2.4.0 is identified as the fixed release.

What can an authenticated attacker do?

An authenticated manager user can create, modify, or delete DataNode definitions.

What should organizations do if they cannot upgrade immediately?

The provided remediation options are to upgrade to Apache InLong 2.4.0 or cherry-pick the referenced fix. No other workaround is specified in the provided information.