Apache InLong 2.0-2.3.x StreamSource Auth Bypass Deletes All Sources
CVE-2026-63040 Published on August 20, 2026
Apache InLong: Missing authorization in StreamSource forceDelete
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12145 .
Vulnerability Analysis
CVE-2026-63040 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.
Weakness Type
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be. Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
Products Associated with CVE-2026-63040
Want to know whenever a new CVE is published for Apache InLong? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache InLong:- Version 2.0.0 and below 2.4.0 is affected.