Access Control Vulnerability in Apache InLong Affecting Unauthorized Stream Source Deletion
CVE-2026-63040

8.1HIGH

Key Information:

Vendor

Apache
Status
Apache Inlong
Vendor
CVE Published:
20 August 2026

What is CVE-2026-63040?

A vulnerability exists in Apache InLong that allows authenticated users to bypass authorization checks within the StreamSource component. This flaw enables any authenticated user to logically delete all stream sources without appropriate permissions. It is critical for users of Apache InLong versions prior to 2.4.0 to update to the latest version to mitigate this risk and ensure the integrity of their stream sources.

Affected Version(s)

Apache InLong 2.0.0 < 2.4.0

References

https://lists.apache.org/thread/sbqrk88cjv3r9rnqfqgn31ox4...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingrui Liu
.