{"id":"CVE-2026-63044","aliases":["EUVD-2026-63477","GHSA-qvfh-v498-xrrf"],"status":"published","title":"Apache InLong: Authenticated SSRF via POST /api/node/testConnection","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00504,"percentile":0.43546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-08-20T15:57:02Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"apache","product":"inlong"},{"vendor":"apache software foundation","product":"apache inlong"}],"references":[{"url":"https://lists.apache.org/thread/b3rtzssd8hdk0dyq4y6mpdx6jj5ro4g6","tags":["vendor-advisory","Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/20/17","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63044"},{"url":"https://github.com/advisories/GHSA-qvfh-v498-xrrf"}],"sources":{"cve":[{"id":"CVE-2026-63044","title":"Apache InLong: Authenticated SSRF via POST /api/node/testConnection","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","status":"published","published":"2026-08-20T15:57:02.234Z","modified":"2026-08-21T18:57:30.703Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-63477","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","status":"published","published":"2026-08-20T15:57:02Z","modified":"2026-08-21T18:57:30Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:37.198267Z"}],"ghsa":[{"id":"GHSA-qvfh-v498-xrrf","title":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no...","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","status":"published","published":"2026-08-20T18:30:54Z","modified":"2026-08-21T21:31:47Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:10:50.012908Z"}],"nvd":[{"id":"CVE-2026-63044","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to\narbitrary internal hosts and ports.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong's  2.4.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/12130 .","status":"published","published":"2026-08-20T16:17:30.483Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:40.302911Z"}]}}