VulnerabilityAnalyzed

CVE-2026-63042

Files or Directories Accessible to External Parties vulnerability in Apache InLong.

HIGH 8.1EPSS 0.51%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12161 .

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-552
Affected: apache/inlong
Source: security@apache.org

References

https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/15Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.