CVE-2026-63040

Apache InLong: Missing authorization in StreamSource forceDelete

View on CVE.org
Published Aug 20, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.



Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/12145 .

Analysis

AI-generated

Technical impact

StreamSource in Apache InLong performs no authorization check when a deletion request is made. The flaw allows any authenticated user to logically delete every stream source, potentially wiping critical data and disrupting services. This results in loss of data integrity and availability, and can lead to broader operational impacts if the deleted streams were part of production pipelines.

Affected Systems

The vulnerability affects Apache InLong versions 2.0.0 through 2.3.x. Users running any of these releases are impacted until they move to version 2.4.0 or greater.

Risk and Exploitability

The CVSS score for this issue is 8.1. The EPSS score is below 1%, indicating a low probability of exploitation. The flaw is confirmed as a vendor‑reported missing authorization, and no known exploit has been documented in the CISA KEV catalog. Inferred from the description, an attacker would need valid authentication to any InLong installation with the affected versions, after which they could invoke the deletion operation. Given the low EPSS, the likelihood of exploitation remains uncertain, but the potential impact is significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official upgrade to Apache InLong 2.4.0 or later
  • Implement the cherry‑pick patch from https://github.com/apache/inlong/pull/12145 if an upgrade is not immediately possible
  • Restrict delete permissions to administrator accounts and enforce least privilege for all users

Generated by OpenCVE AI on August 24, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Apache
Apache inlong
Vendors & Products Apache
Apache inlong
Type Values Removed Values Added
References
Type Values Removed Values Added
Description Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/12145 .
Title Apache InLong: Missing authorization in StreamSource forceDelete
Weaknesses CWE-552
References
Earlier changes (1)
Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Aug 24, 2026, 4:56 PM
Reserved
Jul 15, 2026, 4:02 AM

View source JSON

Updated
Aug 20, 2026, 5:09 PM

JSON

Status
Analyzed
Published
Aug 20, 2026, 4:17 PM
Modified
Oct 18, 2026, 8:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 8:00 PM

JSON