Executive brief
Apache InLong is an open-source data integration platform used for managing data pipelines and node definitions. This vulnerability allows any authenticated user to create, modify, or delete Data Node definitions without proper authorization checks, potentially leading to unauthorized data pipeline modifications and service disruption.
Technical details
The vulnerability is a missing authorization check on DataNode management endpoints in Apache InLong. While authentication is required to access the manager, the application fails to properly verify that the authenticated user has the appropriate permissions to create, modify, or delete Data Node definitions. An authenticated attacker can directly interact with these endpoints to make unauthorized changes to data node configurations. The vulnerability affects versions 2.0.0 through 2.3.x, and is resolved in version 2.4.0 via the authorization control implementation referenced in the patch.
Affected products
- Apache InLong 2.0.0 to before 2.4.0
Timeline
- 2026-08-20: disclosed: CVE-2026-63042 published
- 2026: patched: Fixed in Apache InLong 2.4.0