VulnerabilityAnalyzed

CVE-2026-63044

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.

MEDIUM 5.4EPSS 0.44%

Does this matter?

Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12130 .

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: apache/inlong
Source: security@apache.org

References

https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/20/17Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.