https://seclists.org/oss-sec/2026/q3/538: CVE-2026-63044: Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Q: Who can exploit this issue?

Any authenticated Apache InLong user can exploit it; an administrator role is not required. The attacker needs access to the endpoint and the ability to submit a connection test request.

Q: What systems could be reached through the vulnerable server?

The InLong Manager server can be induced to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. Exposure therefore depends on the network locations that the Manager server itself can reach.

Q: Which deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. The provided information does not identify any configuration prerequisite beyond having an authenticated user.

Q: What should be done if immediate upgrading is not possible?

Cherry-pick the referenced fix, pull request 12130, as an alternative to upgrading to Apache InLong 2.4.0.

Published Aug 20, 2026

Updated

Affected Software

1 affected component

Apache Inlong>2.0.0<=2.4.0

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Apache InLong user can exploit it; an administrator role is not required. The attacker needs access to the endpoint and the ability to submit a connection test request.

What systems could be reached through the vulnerable server?

The InLong Manager server can be induced to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. Exposure therefore depends on the network locations that the Manager server itself can reach.

Which deployments are affected?

Apache InLong versions from 2.0.0 before 2.4.0 are affected. The provided information does not identify any configuration prerequisite beyond having an authenticated user.

What should be done if immediate upgrading is not possible?

Cherry-pick the referenced fix, pull request 12130, as an alternative to upgrading to Apache InLong 2.4.0.