Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into
the SQL statement, enabling SQL injection.


This issue affects Apache InLong: from 2.0.0 before 2.4.0.



Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12080 .
Published: 2026-08-20
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of special elements used in an SQL command in Apache InLong’s AuditAlertRuleService. Unvalidated MyBatis dollar‑sign interpolation allows an attacker to inject arbitrary SQL statements, potentially exposing or modifying sensitive data. This flaw is a classic SQL injection (CWE‑89) and can lead to confidentiality and integrity violations.

Affected Systems

Apache InLong versions from 2.0.0 up to but not including 2.4.0 are vulnerable. Both the 2.2.x and 2.3.x series fall within this range.

Risk and Exploitability

The issue is not listed in the CISA Known Exploited Vulnerabilities catalog and no EPSS score is available, so the exact exploitation probability is unknown. However, because the vulnerability can be exploited through the exposed service interface, it is likely remotely exploitable. Given the severity of SQL injection, the risk is considered high until a patch is applied.

Generated by OpenCVE AI on August 20, 2026 at 20:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache InLong to version 2.4.0 or apply the cherry‑pick referenced by pull request 12080 to remediate the vulnerable code.
  • Restrict access to the AuditAlertRuleService interface, limiting exposure to trusted administrators or internal components.
  • Continuously monitor application logs for suspicious SQL activity that could indicate attempted exploitation of the injection flaw.

Generated by OpenCVE AI on August 20, 2026 at 20:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache inlong
Vendors & Products Apache
Apache inlong

Thu, 20 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
References

Thu, 20 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12080 .
Title Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
Weaknesses CWE-89
References

Subscriptions

Apache Inlong
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-20T17:09:18.391Z

Reserved: 2026-07-15T03:48:07.408Z

Link: CVE-2026-63039

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T16:17:29.877

Modified: 2026-08-20T17:19:14.497

Link: CVE-2026-63039

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')