Quick answers
- Is CVE-2026-63040 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63040 being exploited in the wild.
- How severe is CVE-2026-63040?
- High severity, with a CVSS score of 8.1, published 20 August 2026.
- Which products and versions are affected?
- Apache Inlong 2.0.0 to before 2.4.0.
- Is there a fix for CVE-2026-63040?
- A patch was published on 2026-08-20: Apache InLong 2.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63040 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-63040?
- Check whether you run Apache Inlong at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the StreamSource forceDelete API endpoint. The component performs no authorization checks before allowing deletion operations, meaning any authenticated user—regardless of their intended permissions—can logically delete all stream sources. The attack vector is network-based and requires authentication but no special privileges. An attacker with valid credentials can invoke the vulnerable endpoint to remove critical stream source configurations, impacting data collection and integration workflows. The issue is resolved in Apache InLong 2.4.0 via pull request #12145.
Affected products
- Apache InLong 2.0.0 to before 2.4.0
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Apache InLong 2.4.0 released with fix