CVE-2026-63042

CVE-2026-63042: Apache InLong: Missing authorization on DataNode management endpoints

Vendor Apache Software Foundation

Product Apache InLong

Weakness CWE-552 · Files accessible externally

Published August 20, 2026

Last update August 20, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12161 .

Key dates

02Disclosure timeline

August 20, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-63042 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/552.html AskarLabs — CWE-552 write-up Files or Directories Accessible to External Parties

Related vulnerabilities

04Related CVE

CVE-2022-0656 uDraw < 3.3.3 - Unauthenticated Arbitrary File Access CVE-2025-12648 WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files CVE-2021-24154 Theme Editor < 2.6 - Authenticated Arbitrary File Download CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download CVE-2025-14442 Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File