CVE-2026-63044

Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Published Aug 20, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to
arbitrary internal hosts and ports.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/12130 .

Analysis

Technical impact

Apache InLong exposes a server‑side request forgery flaw through the POST /api/node/testConnection endpoint. Any authenticated user, regardless of having an administrative role, can instruct the InLong Manager to open outbound HTTP or TCP connections to arbitrary internal hosts and ports. This breach exposes internal network resources to enumeration or potential exploitation and represents a CWE‑918 weakness in the input handling of the SSRF endpoint.

Affected Systems

The vulnerability affects Apache InLong versions from 2.0.0 up to, but not including, 2.4.0. The product is maintained by the Apache Software Foundation.

Risk and Exploitability

The CVSS score of 5.4 classifies this flaw as moderate, and the EPSS score of <1% indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog, so no known public exploits are documented. Nevertheless, authenticated users, regardless of role, can direct the InLong Manager to open outbound connections to arbitrary internal hosts, which can expose internal services and broaden the attack surface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache InLong

unaffected

Version	Status	Constraints
`2.0.0`	affected	< 2.4.0

Configuration 1 [-]

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Inlong

Version	Status	Scheme	Platform
`[2.0.0,2.4.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache InLong to version 2.4.0 or apply the official patch from pull request 12130
If upgrading is not immediately possible, restrict the /api/node/testConnection endpoint to administrative users only or remove the endpoint from the production deployment
Implement network segmentation or firewall rules to block outbound connections from the InLong Manager to internal networks, limiting the reach of any SSRF attack

Generated by OpenCVE AI on August 21, 2026 at 20:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.504% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/08/20/17
https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6

History

Aug 27, 2026 12:15 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:inlong::::::::

Aug 21, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache inlong
Vendors & Products		Apache Apache inlong

Aug 20, 2026 5:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/08/20/17

Aug 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12130 .
Title		Apache InLong: Authenticated SSRF via POST /api/node/testConnection
Weaknesses		CWE-918
References		https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6