CVE-2026-63039

Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

Published Aug 20, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into
the SQL statement, enabling SQL injection.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12080 .

Analysis

Technical impact

The vulnerability is an improper neutralization of special elements used in an SQL command in Apache InLong’s AuditAlertRuleService. Unvalidated MyBatis dollar‑sign interpolation allows an attacker to inject arbitrary SQL statements, potentially exposing or modifying sensitive data. This flaw is a classic SQL injection (CWE‑89) and can lead to confidentiality and integrity violations.

Affected Systems

Apache InLong versions from 2.0.0 up to but not including 2.4.0 are vulnerable. Both the 2.2.x and 2.3.x series fall within this range.

Risk and Exploitability

The issue is not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The CVSS score is 9.8, reflecting a critical severity. However, because the vulnerability can be exploited through the exposed service interface, it is likely remotely exploitable. Given the severity of SQL injection, the risk remains high until a patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache InLong

unaffected

Version	Status	Constraints
`2.0.0`	affected	< 2.4.0

Configuration 1 [-]

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Inlong

Version	Status	Scheme	Platform
`[2.0.0,2.4.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache InLong to version 2.4.0 or apply the cherry‑pick referenced by pull request 12080 to remediate the vulnerable code.
Restrict access to the AuditAlertRuleService interface, limiting exposure to trusted administrators or internal components.
Continuously monitor application logs for suspicious SQL activity that could indicate attempted exploitation of the injection flaw.

Generated by OpenCVE AI on August 24, 2026 at 19:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.686% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/08/20/13
https://lists.apache.org/thread/wzpsgwcx2hxj025pcml0loxr16kl93qt

History

Aug 27, 2026 12:15 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:inlong::::::::

Aug 24, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 20, 2026 6:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache inlong
Vendors & Products		Apache Apache inlong

Aug 20, 2026 5:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/08/20/13

Aug 20, 2026 4:00 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12080 .
Title		Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
Weaknesses		CWE-89
References		https://lists.apache.org/thread/wzpsgwcx2hxj025pcml0loxr16kl93qt