Executive brief
Apache InLong is a distributed data integration framework used to ingest and manage data streams. A missing authorization check in the StreamSource deletion function allows any authenticated user to delete all stream sources in the system, potentially disrupting data pipelines and causing data loss or service unavailability.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the StreamSource forceDelete API endpoint. The component performs no authorization checks before allowing deletion operations, meaning any authenticated user—regardless of their intended permissions—can logically delete all stream sources. The attack vector is network-based and requires authentication but no special privileges. An attacker with valid credentials can invoke the vulnerable endpoint to remove critical stream source configurations, impacting data collection and integration workflows. The issue is resolved in Apache InLong 2.4.0 via pull request #12145.
Affected products
- Apache InLong 2.0.0 to before 2.4.0
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Apache InLong 2.4.0 released with fix