Apache Atlas contains a code injection flaw in its DSL search endpoint that allows an attacker to manipulate Gremlin traversal logic within the accepted grammar. By supplying a crafted query string, the attacker can modify the internal traversal logic and retrieve data not intended to be exposed. This vulnerability is classified under CWE‑94 and can lead to unauthorized access to sensitive data stored in Atlas.

The flaw affects Apache Atlas versions 0.8 through 2.4.0. For installations running Atlas 2.0 or newer the issue is only triggered when the configuration parameter atlas.dsl.executor.traversal is set to false. All other default deployments are unaffected.

The CVSS score of 7.1 indicates a medium to high severity. No EPSS value is currently available, so the precise exploitation likelihood cannot be quantified, but the vulnerability is included in the public advisory and is not yet listed in the CISA KEV catalog. Attackers can target the exposed DSL endpoint over the network, and because the flaw does not require privileged input beyond a crafted query, the practical barrier to entry is low. The potential impact of data exposure combined with moderate exploitation risk warrants prompt remediation.