Executive brief
Apache InLong is an open-source data integration platform used to manage and orchestrate data pipelines. An unauthenticated SSRF vulnerability allows any authenticated user to force the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports, potentially exposing sensitive internal services or enabling lateral movement within a network.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the POST /api/node/testConnection endpoint of Apache InLong Manager. Any authenticated user without requiring administrative privileges can submit a crafted request to cause the server to initiate outbound connections to arbitrary internal or external hosts and ports. This allows attackers to probe internal network topology, interact with internal services, access metadata endpoints, or pivot to other systems. The vulnerability affects versions 2.0.0 through 2.3.x, and patches are available in version 2.4.0 or via the referenced pull request.
Affected products
- Apache InLong 2.0.0 to 2.3.x
Timeline
- 2026-08-20: disclosed: CVE-2026-63044 disclosed via oss-security mailing list
- 2026-08-20: patched: Fix available in Apache InLong 2.4.0