VulnerabilityAnalyzed

CVE-2026-63040

Files or Directories Accessible to External Parties vulnerability in Apache InLong.

HIGH 8.1EPSS 0.51%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12145 .

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-552
Affected: apache/inlong
Source: security@apache.org

References

https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4711offyMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/14Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.