Apache Inlong
Apache · 41 CVEs
Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Aug 21, 2026
Apache InLong: Authenticated SSRF via POST /api/node/testConnection
Aug 20, 2026
Apache InLong: Agent path traversal via unvalidated file source path
Aug 20, 2026
Apache InLong: Missing authorization on DataNode management endpoints
Aug 20, 2026
Apache InLong: Missing authorization in StreamSource forceDelete
Aug 20, 2026
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
Aug 20, 2026
Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Aug 20, 2026
Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Aug 20, 2026
Apache InLong: Ordinary users can create new packages
Aug 20, 2026
Apache InLong: Non-template responsible persons can view template information
Aug 20, 2026
Apache InLong: An arbitrary file read vulnerability for JDBC
Jun 6, 2025
Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read
May 28, 2025
Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass
May 28, 2025
Apache InLong: JDBC Vulnerability during verification processing
May 28, 2025
Apache InLong TubeMQ Client: Remote Code Execution vulnerability
Aug 2, 2024
Apache Inlong JDBC Vulnerability
May 8, 2024
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Mar 6, 2024
Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager
Jan 3, 2024
Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager
Jan 3, 2024
Apache inlong has an Arbitrary File Read Vulnerability
Oct 19, 2023
Apache InLong: General user Unauthorized access User Management
Oct 16, 2023
Apache InLong: Log Injection in Global functions
Oct 16, 2023
Apache InLong: Jdbc Connection Security Bypass in InLong
Oct 16, 2023
Apache InLong: SQL injection in audit endpoint
Jul 25, 2023
Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
Jul 25, 2023
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials | HIGH | 0.68% | Aug 21, 2026 |
| CVE-2026-63044 | Apache InLong: Authenticated SSRF via POST /api/node/testConnection | MEDIUM | 0.50% | Aug 20, 2026 |
| CVE-2026-63043 | Apache InLong: Agent path traversal via unvalidated file source path | HIGH | 0.81% | Aug 20, 2026 |
| CVE-2026-63042 | Apache InLong: Missing authorization on DataNode management endpoints | HIGH | 0.64% | Aug 20, 2026 |
| CVE-2026-63040 | Apache InLong: Missing authorization in StreamSource forceDelete | HIGH | 0.64% | Aug 20, 2026 |
| CVE-2026-63039 | Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService | CRITICAL | 0.69% | Aug 20, 2026 |
| CVE-2026-63038 | Apache InLong: SQL Injection via String Concatenation Vulnerability Report | CRITICAL | 0.69% | Aug 20, 2026 |
| CVE-2026-63037 | Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint | CRITICAL | 0.69% | Aug 20, 2026 |
| CVE-2026-63016 | Apache InLong: Ordinary users can create new packages | MEDIUM | 0.63% | Aug 20, 2026 |
| CVE-2026-63015 | Apache InLong: Non-template responsible persons can view template information | MEDIUM | 0.56% | Aug 20, 2026 |
| CVE-2025-27531 | Apache InLong: An arbitrary file read vulnerability for JDBC | HIGH | 0.66% | Jun 6, 2025 |
| CVE-2025-27528 | Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | MEDIUM | 0.68% | May 28, 2025 |
| CVE-2025-27526 | Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | MEDIUM | 0.80% | May 28, 2025 |
| CVE-2025-27522 | Apache InLong: JDBC Vulnerability during verification processing | HIGH | 0.84% | May 28, 2025 |
| CVE-2024-36268 | Apache InLong TubeMQ Client: Remote Code Execution vulnerability | HIGH | 1.17% | Aug 2, 2024 |
| CVE-2024-26579 | Apache Inlong JDBC Vulnerability | CRITICAL | 1.14% | May 8, 2024 |
| CVE-2024-26580 | Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability | CRITICAL | 1.22% | Mar 6, 2024 |
| CVE-2023-51784 | Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager | CRITICAL | 1.62% | Jan 3, 2024 |
| CVE-2023-51785 | Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager | HIGH | 1.01% | Jan 3, 2024 |
| CVE-2023-46227 | Apache inlong has an Arbitrary File Read Vulnerability | HIGH | 0.97% | Oct 19, 2023 |
| CVE-2023-43666 | Apache InLong: General user Unauthorized access User Management | MEDIUM | 0.43% | Oct 16, 2023 |
| CVE-2023-43667 | Apache InLong: Log Injection in Global functions | HIGH | 1.23% | Oct 16, 2023 |
| CVE-2023-43668 | Apache InLong: Jdbc Connection Security Bypass in InLong | CRITICAL | 1.01% | Oct 16, 2023 |
| CVE-2023-35088 | Apache InLong: SQL injection in audit endpoint | CRITICAL | 1.64% | Jul 25, 2023 |
| CVE-2023-34434 | Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param | HIGH | 1.70% | Jul 25, 2023 |
Showing 1 to 25 of 41 CVEs