{"id":"CVE-2026-63044","state":"PUBLISHED","title":"Apache InLong: Authenticated SSRF via POST /api/node/testConnection","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","publishedAt":"2026-08-20T15:57:02.234Z","updatedAt":"2026-08-21T18:57:30.703Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache InLong"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache InLong","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.4.0","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6","http://www.openwall.com/lists/oss-security/2026/08/20/17"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63044.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63044","state":"PUBLISHED","datePublished":"2026-08-20T15:57:02.234Z","dateUpdated":"2026-08-21T18:57:30.703Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-07-15T07:08:41.577Z"},"containers":{"cna":{"title":"Apache InLong: Authenticated SSRF via POST /api/node/testConnection","descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 ."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache InLong","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.4.0","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-08-20T15:57:02.234Z"},"credits":[{"lang":"en","type":"finder","value":"Geo"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/08/20/17"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-08-20T17:09:23.194Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-21T18:57:12.692014Z","id":"CVE-2026-63044","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-21T18:57:30.703Z"}}]}}}