Executive brief
Apache InLong is an open-source data integration platform used for managing data pipelines. An unauthenticated SQL injection vulnerability in the Manager OpenAPI audit alert rule list endpoint allows attackers to inject malicious SQL commands, potentially leading to unauthorized database access, data theft, or data manipulation on the backend system.
Technical details
This is an SQL injection vulnerability (CWE-89) in the ORDER BY clause of the Manager backend API endpoint for listing audit alert rules. The vulnerability is unauthenticated, meaning no credentials are required to exploit it. An attacker can inject specially crafted SQL through the affected endpoint to manipulate database queries, potentially exfiltrating sensitive data or modifying database records. The vulnerability affects Apache InLong versions 2.0.0 through 2.3.x, and is fixed in version 2.4.0 or via the commit referenced in the advisory.
Affected products
- Apache InLong 2.0.0 to 2.3.x
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fix available in version 2.4.0