Vulnerability intelligence

CVE-2026-63044

Apache Software Foundation Apache InLong CWE-918

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12130 .

CVSS Score

5.4

Medium

EPSS — Exploit Probability

0.5%

Riskier than 41% of all CVEs · checked 2026-10-03

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories